← Remote Workers

86.106.85.234

86.106.85.234 is an IP address that 3 published sources report in connection with Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from Blackpoint Cyber and Red Asgard. The earliest of those reports is dated 2025-10-06 and the most recent 2026-02-03.

ip address Contagious Interview MATCHED IN SOURCE

First seen 2025-10-06 · last seen 2026-02-03

Network

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

• …It implements an asynchronous makeLog(message) routine that issues an HTTP POST to http[://]86.106.85.234/api/service/makelog, packaging the supplied message along with the local hostname, the static UID, and a type flag t: 5 as JSON.…

  Malicious Node Package Deploys OtterCookie — Blackpoint Cyber · under “From Pyongyang with Love” · published 2025-10-06 · pulled 2026-09-12

• …1247 BeaverTail backup Active 172.86.105.40 5918 OtterCookie victim C2 Active 172.86.116.178 5918 OtterCookie victim C2 Active 86.106.85.234 4558 OtterCookie victim C2 Active 144.172.104.117 5918 OtterCookie victim C2 Active 144.172.101.45 1224 OtterCookie victim C2 Active…

  Hunting Lazarus Part IV: Real Blood on the Wire — Red Asgard · under “IP Addresses” · published 2026-02-03 · pulled 2026-09-12

• …147.124.214.129, 66.235.168.238, 45.59.163.55, 216.250.251.87 OtterCookie C2s (confirmed): 172.86.105.40, 172.86.116.178, 86.106.85.234, 144.172.104.117, 144.172.101.45 Detection opportunity: Any server presenting this port configuration—particularly the unusual…

  Hunting Lazarus Part III: The Infrastructure That Was Too Perfect — Red Asgard · under “Both Families, Same Servers” · published 2026-02-01 · pulled 2026-10-01

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Malicious Node Package Deploys OtterCookie

Blackpoint Cyber lists 7 other indicators in this source. 5 are shown, chosen across types.

• https://github.com/terin6 GitHub account
• serve-cookie.vercel.app hosted site
• 146.70.87.202 IP address
• 193.187.148.116 IP address
• 86.106.85.90 IP address

All 8 indicators from this source

Cited by the same report: Hunting Lazarus Part IV: Real Blood on the Wire

Red Asgard lists 7 other indicators in this source. 4 are shown, chosen across types.

• 144.172.101.45 IP address
• 144.172.104.117 IP address
• 147.124.212.125 IP address
• 172.86.105.40 IP address

All 8 indicators from this source

Cited by the same report: Hunting Lazarus Part III: The Infrastructure That Was Too Perfect

Red Asgard lists 3 other indicators in this source. 2 are shown, chosen across types.

• tetrismic.vercel.app domain
• 172.86.116.178 IP address

All 4 indicators from this source