← Remote Workers

166.88.132.39

166.88.132.39 is an IP address that 3 published sources report in connection with Lazarus Group and Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from Ransom-ISAC, Threat Book and JPCERT/CC. The earliest of those reports is dated 2025-11-13 and the most recent 2026-11-09.

ip address Lazarus GroupContagious Interview MATCHED IN SOURCE

First seen 2025-11-13 · last seen 2026-11-09

Network

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

• …Feb-25 DeimosC2 166.88.99.15 Feb-25 Cobalt Strike (Watermark: Unknown) 166.88.55.54 Feb-25 Cobalt Strike (Watermark: Unknown) 166.88.132.39 Nov-25 DPRK Lazarus, Contagious Interview 166.88.159.187 Jun-25 FIN7 166.88.159.37 Oct-24 FIN7 193.57.57.121 Jan-25 Cobalt Strike…

  Cross-Chain TxDataHiding Crypto Heist: A Very Chainful Process (Part 1) — Ransom-ISAC · under “1. ASN IOCs (High-Medium Degree of Confidence)” · published 2025-11-13 · pulled 2026-09-12

• ….79.23 147.124.212.146 147.124.212.89 147.124.213.11 147.124.213.17 147.124.213.29 147.124.214.129 147.124.214.131 147.124.214.237 166.88.132.39 167.88.164.29 167.88.168.152 167.88.168.24 172.86.100.168 172.86.123.35 172.86.97.80 172.86.98.240 173.211.106.101 185.235.241.208…

  Lazarus' Espionage-related Cryptocurrency Activities Remain Active, With A Significant Amount of Assets Still in Circulation — Threat Book · under “Appendix - IOC” · published 2024-10-23 · pulled 2026-09-12

• …147.124.197.149 147.124.212.146 147.124.212.89 147.124.213.11 147.124.213.29 147.124.214.129 147.124.214.131 147.124.214.237 165.140.86.227 166.88.132.39 167.88.164.29 167.88.168.152 172.86.100.168 172.86.106.119 172.86.109.3 172.86.123.35 172.86.123.55 172.86.66.236 172.86.66.247 172.86.70.1…

  Contagious Interview IoCs — JPCERT/CC · published 2025-08-25 · pulled 2026-09-18

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Cross-Chain TxDataHiding Crypto Heist: A Very Chainful Process (Part 1)

Ransom-ISAC lists 131 other indicators in this source. 5 are shown, chosen across types.

• 742016f01fa89be4d43916d5d2349c8d86dc89f096302501ec22b5c239685a20 file hash
• 166.88.132.69 IP address
• 166.88.14.137 IP address
• 166.88.14.44 IP address
• 166.88.14.52 IP address

All 132 indicators from this source

Cited by the same report: Lazarus' Espionage-related Cryptocurrency Activities Remain Active, With A Significant Amount of Assets Still in Circulation

Threat Book lists 40 other indicators in this source. 4 are shown, chosen across types.

• 5cce14436b3ae5315feec2e12ce6121186f597b3 file hash
• 8ebca0b7ef7dbfc14da3ee39f478e880 file hash
• 167.88.164.29 IP address
• 167.88.168.152 IP address

All 41 indicators from this source

Cited by the same report: Contagious Interview IoCs

JPCERT/CC lists 539 other indicators in this source. 3 are shown, chosen across types.

• 167.114.0.144 IP address
• 167.114.48.58 IP address
• 167.71.14.135 IP address

All 540 indicators from this source