167.88.61.250
167.88.61.250 is an IP address
that 3 published sources report
in connection with IT Worker Fraud and Contagious Interview activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Nisos and Silent Push.
The earliest of those reports is dated 2025-02-28 and the most recent 2026-06-16.
ip address IT Worker FraudContagious Interview MATCHED IN SOURCE
Network
| Kind | proxy or VPN |
|---|---|
| Network | GlobalTeleHost Corp. |
| Announced by | AS63023 GTHost |
| Country | United States |
| Flags | hosting range, known proxy or VPN |
Sources
-
Nisos reports that a suspected DPRK operative applied to its own remote Lead AI Architect role in June 2025 using a stolen identity, a newly created address and an AI-written resume, posing as a Florida-based developer; it interviewed him on 24 June 2025, then hired him under a retainer, shipped a monitored laptop to an address in Palm Bay, Florida, and through it observed a laptop farm and the team coordinating his applications. NBC News, which reviewed Nisos's material, says the researchers came to know him as Jo, which is the beginning of the redacted address and not a name he presented, so no persona is anchored here. Nisos withholds his name to protect the real person whose details were used; the telephone number and the two addresses, which Nisos attributes to the Astrill VPN service, are the values it publishes.
nisos.com/research/exposing-fraudulent-dprk-candidate/ — Nisos -
…analysis of the operative who applied to Nisos revealed TTPs consistent with DPRK IT workers: use of Astrill VPN (IP addresses 167.88.61.250 and 167.88.61.117); deployment of PiKVM devices for undetectable remote access to corporate laptops; and use of Tailscale mesh VPN to…
Exposing DPRK Employment Fraud Operations — Nisos -
…our investigation continues. Here is the sample list of IP addresses: 103.130.145.210 104.129.22.2 113.20.30.139 134.195.197.175 167.88.61.250 169.38.132.135 169.57.129.31 172.93.100.166 172.96.141.172 185.108.128.54 Continuing to Track Astrill VPN Our team continues…
Astrill VPN: Silent Push Publicly Releases New IPs on VPN Service Heavily Used by North Korean Threat Actors — Silent Push -
…role using the following PII. Phone: 850-308-4867 Email address: Jo***@gmail.com Address: Palm Beach Gardens, FL 33410 IPs: 167.88.61.250 and 167.88.61.117 Graphic 1: Image of the suspected DPRK operative during the interview.…
Exposing a Fraudulent DPRK Candidate — Nisos
Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.