`88.218.0.78`

88.218.0.78 is an IP address that 5 published sources report in connection with Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from Ossprey, NVISO, Recorded Future, Deriv Tech and JPCERT/CC. The earliest of those reports is dated 2025-10-20 and the most recent 2026-11-09.

ip address Contagious Interview MATCHED IN SOURCE

First seen 2025-10-20 · last seen 2026-11-09

Network

Kind	data centre
Network	M247 Europe-Manchester (M247 Ltd Manchester)
Announced by	AS9009 M247 Europe SRL
Country	United Kingdom
Flags	hosting range

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

…Five of ours appear on it: 23.227.202.244 , 146.70.253.107 , 45.61.150.31 , 88.218.0.78 and 5.253.43.122 .…
Uncovering a 300+ Package DPRK Contagious Interview Campaign — Ossprey · under “The shape of the network” · published 2026-07-02 · pulled 2026-09-02
…45.61.150.31 45.61.151.71 45.76.160.53 5.253.43.122 66.235.168.232 66.235.175.109 67.203.7.163 67.203.7.171 86.104.74.51 88.218.0.78 94.131.97.195 95.164.17.24 Markdown Tsunami Indicators http[ :// ]23.254.164.156/introduction-video https[ ://…
Contagious Interview Actors Now Utilize JSON Storage Services for Malware Delivery — NVISO · under “Indicators of Compromise (IOCs)” · published 2025-11-13 · pulled 2026-09-12
…45.61.160.28 45.61.165.45 66.235.168.17 66.235.168.232 66.235.168.238 66.235.175.109 66.235.175.117 67.203.7.163 67.203.7.200 67.203.7.205 88.218.0.78 107.189.24.80 144.172.95.226 144.172.100.124 144.172.100.142 144.172.102.21 144.172.102.148 144.172.103.97 144.172.104.113 144.172.105.189…
PurpleBravo’s Targeting of the IT Software Supply Chain — Recorded Future · under “Appendix B: C2 Servers” · published 2026-01-21 · pulled 2026-09-12
…Data Exfiltration: Stolen credentials/wallets → 88.218.0.78:1224/uploads (POST, multipart/form-data) File scanner results → 172.86.89.10:4382/upload (screenshots, keylog data, scanned…
How a fake AI recruiter delivers five staged malware disguised as a dream job — Deriv Tech · under “Stage 1: JavaScript InfoStealer” · published 2025-10-20 · pulled 2026-09-12
…2 66.235.168.238 67.203.123.171 67.203.7.163 67.203.7.171 67.203.7.200 67.203.7.209 67.203.7.245 69.197.164.117 74.119.194.129 86.104.74.51 88.218.0.78 91.198.66.112 91.198.66.158 91.92.120.135 93.127.134.237 94.131.97.195 94.131.9.32 94.232.247.192 95.164.17.24 95.164.33.66 95.164.45.239 9…
Contagious Interview IoCs — JPCERT/CC · published 2025-08-25 · pulled 2026-09-18

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Uncovering a 300+ Package DPRK Contagious Interview Campaign

Ossprey lists 14 other indicators in this source. 5 are shown, chosen across types.

All 15 indicators from this source

Cited by the same report: Contagious Interview Actors Now Utilize JSON Storage Services for Malware Delivery

NVISO lists 67 other indicators in this source. 4 are shown, chosen across types.

All 68 indicators from this source

Cited by the same report: PurpleBravo’s Targeting of the IT Software Supply Chain

Recorded Future lists 216 other indicators in this source. 3 are shown, chosen across types.

All 217 indicators from this source