← Remote Workers

185.175.59.85

185.175.59.85 is an IP address that 2 published sources report in connection with Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from Decryption Digest and Wiz. The earliest of those reports is dated 2026-05-27 and the most recent 2026-05-28.

ip address Contagious Interview MATCHED IN SOURCE

First seen 2026-05-27 · last seen 2026-05-28

Network

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

• …of Compromise Copy IOCs Artifact Type Context / Hash datahub.ink Domain (C2) AUDIOFIX primary C2, resolves to 208.115.220.17, 185.175.59.85 cloud-sync.online Domain (C2) AUDIOFIX secondary C2 for credential exfiltration byte-io.us Domain (C2) AUDIOFIX tertiary C2 and…

  JINX-0164 Cryptocurrency Malware: AUDIOFIX Wallet Theft (2026) — Decryption Digest · under “How Does JINX-0164 Cryptocurrency Malware Work?” · published 2026-05-28 · pulled 2026-09-12

• …45.45.217.242 C&C Domains Domain IP Target cloud-sync.online N/A datahub.ink 208.115.220.17 185.175.59.85 byte-io.us N/A Host-Based Indicators File Path Description ~/Library/LaunchAgents/com.microsoft.teams.coreaudiod.plist…

  Commit to Compromise: A New Threat Actor Targeting the Cryptocurrency Industry's Software Development Infrastructure — Wiz · under “C&C Domains” · published 2026-05-27 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: JINX-0164 Cryptocurrency Malware: AUDIOFIX Wallet Theft (2026)

Decryption Digest lists 7 other indicators in this source.

• 65cba741fe30fa4799fb9002ea8de6d96042a59159dd7c3419c766af24c835e6 file hash
• 153.92.126.84 IP address
• 185.100.85.250 IP address
• 208.115.220.17 IP address
• 45.45.217.242 IP address
• 84.32.83.250 IP address
• 89.36.224.5 IP address

Cited by the same report: Commit to Compromise: A New Threat Actor Targeting the Cryptocurrency Industry's Software Development Infrastructure

Wiz lists 10 other indicators in this source. 4 are shown, chosen across types.

• nord-stream@localhost.com email address
• 0a8ab3d16b12d3a453ee5a3208fe04744ad54514ef8ea27bb8fe32679efad270 file hash
• 163.172.53.20 IP address
• 185.100.85.98 IP address

All 11 indicators from this source