`166.88.54.158`

166.88.54.158 is an IP address that 3 published sources report in connection with Contagious Interview and PolinRider activity, which public reporting attributes to North Korea (DPRK). It is cited here from Panther Labs, SafeDep and OpenSourceMalware. The earliest of those reports is dated 2026-04-24 and the most recent 2026-08-13.

On-chain links

EtherHiding addresses that pointed malware at this host, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. See the EtherHiding Tracker.

Address	Transaction	Type	Role	Malware family	First written	Last written
`txfxhuet9pjvu1bgvkbabres4yuc1ngzcg`	BscScan	Wallet, tron	pointer wallet	DEV#POPPER.js	2026-03-26	2026-06-20

ip address Contagious Interview PolinRider MATCHED IN SOURCE

First seen 2026-04-24 · last seen 2026-08-13

Network

Kind	data centre
Network	Ace Data Centers II (Evoxt)
Announced by	AS149440 Evoxt Sdn. Bhd.
Country	United Kingdom
Flags	hosting range

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

…the recovered loader, the actor populates initial blockchain state from an embedded bootstrap, selects direct follow-on C2 candidates at 166.88.54.158:443 , 198.105.127.210:443 , and 23.27.202.27 on 443 or 27017 , rotates the next-cycle TRON pointer wallet, and assigns a next-stage BSC…
Inside DPRK’s npm Malware Factory: 108 Packages & 261 Versions — Panther Labs · under “Cluster I: Blockchain dead-drop C2” · published 2026-04-24 · pulled 2026-09-02
…homepage/astro.config.mjs @ 8d30be36 3 const marker = global._V || 0 ; 4 5 if (marker[ 0 ] === "A" ) { 6 global._H2 = "http://166.88.54.158" ; 7 } else if ( ! isNaN ( parseInt (marker))) { 8 global._H2 = "http://198.105.127.210" ; 9 } else { 10 global._H =…
astro.config.mjs Supply Chain Attack via Blockchain C2 - Real-time Open Source Software Supply Chain Security — SafeDep · under “Stage B: C2 selection and boot beacon” · published 2026-06-12 · pulled 2026-09-11
…the network layer There are several known malicious IPs worth an interim block at the firewall level while you work through remediation: 166.88.54.158 , 198.105.127.210 , 23.27.202.27 , 154.91.0.103 , 136.0.9.8 , 166.88.4.2 , 23.27.120.142 , 202.155.8.173 , 166.88.134.82 , 188.43.33.249 ,…
A Developer's Guide to Getting Rid of PolinRider | OpenSourceMalware — OpenSourceMalware · under “4. Block known indicators at the network layer” · published 2026-08-13 · pulled 2026-09-12
…_H2 = "http://166.88.54.158" ; } else if ( ! isNaN ( parseInt ( marker ))) { global .…
astro.config.mjs Supply Chain Attack via Blockchain C2 - Real-time Open Source Software Supply Chain Security — SafeDep · under “Stage B: C2 selection and boot beacon” · published 2026-06-12 · pulled 2026-11-13

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Inside DPRK’s npm Malware Factory: 108 Packages & 261 Versions

Panther Labs lists 97 other indicators in this source. 5 are shown, chosen across types.

All 98 indicators from this source

Cited by the same report: astro.config.mjs Supply Chain Attack via Blockchain C2 - Real-time Open Source Software Supply Chain Security

SafeDep lists 2 other indicators in this source.

Cited by the same report: A Developer's Guide to Getting Rid of PolinRider | OpenSourceMalware

OpenSourceMalware lists 7 other indicators in this source. 5 are shown, chosen across types.

All 8 indicators from this source