← Remote Workers

216.250.251.87

216.250.251.87 is an IP address that 5 published sources report in connection with Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from ENKI and Red Asgard. The earliest of those reports is dated 2026-01-12 and the most recent 2026-02-27.

ip address Contagious Interview MATCHED IN SOURCE

First seen 2026-01-12 · last seen 2026-02-27

Network

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

• …vscode-load.onrender.com 2026-01-20 2026-02-26 IPv4 147.124.213.232 2026-01-12 2026-02-26 IPv4 216.250.251.87 2026-01-12 2026-02-26 IPv4 45.59.163.55 2026-01-12 2026-02-26 IPv4 66.235.175.109 2025-11-13…

  Contagious Interview Campaign Abusing VSCode Distributed on Github - ENKI | lazarus.day — ENKI · under “Indicators of Compromise” · published 2026-02-26 · pulled 2026-09-01

• …IP Hostname ASN Role 147.124.213.232 WR232 AS396073 (Majestic Hosting) Primary C2 147.124.212.125 W9_125 AS396073 Secondary C2 216.250.251.87 WIN-8OA3CCQAE4D AS396073 Backup 45.43.11.199 WIN-4MOD9QVI0EN AS397423 (TIER-NET) Router (offline) 66.235.63.55 - AS397423 MetaMask…

  Hunting Lazarus: Inside the Contagious Interview C2 Infrastructure — Red Asgard · under “Stage 2: Dedicated C2 Servers” · published 2026-01-12 · pulled 2026-09-12

• …C2 Active 66.235.168.238 1244, 22411-22413 BeaverTail + binary protocol Active 45.59.163.55 1244 BeaverTail victim C2 Active 216.250.251.87 1247 BeaverTail backup Active 172.86.105.40 5918 OtterCookie victim C2 Active 172.86.116.178 5918 OtterCookie victim C2 Active…

  Hunting Lazarus Part IV: Real Blood on the Wire — Red Asgard · under “IP Addresses” · published 2026-02-03 · pulled 2026-09-12

• …type OS release OS version Following the upload, it establishes a socket connection with the C&C server at 216.250.251.87:1247 . caption - Socket connection routine Once connected, it receives a code value from the C&C server and performs actions based on…

  Contagious Interview Campaign Abusing VSCode Distributed on Github — ENKI · under “n.js” · published 2026-02-27 · pulled 2026-09-12

• …from both campaigns. BeaverTail C2s (confirmed): 147.124.213.232, 147.124.212.125, 147.124.214.129, 66.235.168.238, 45.59.163.55, 216.250.251.87 OtterCookie C2s (confirmed): 172.86.105.40, 172.86.116.178, 86.106.85.234, 144.172.104.117, 144.172.101.45 Detection…

  Hunting Lazarus Part III: The Infrastructure That Was Too Perfect — Red Asgard · under “Both Families, Same Servers” · published 2026-02-01 · pulled 2026-10-01

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Contagious Interview Campaign Abusing VSCode Distributed on Github - ENKI | lazarus.day

ENKI lists 14 other indicators in this source. 5 are shown, chosen across types.

• 38.92.47.152 IP address
• 45.59.163.23 IP address
• 45.59.163.55 IP address
• 66.235.11.117 IP address
• 66.235.175.109 IP address

All 15 indicators from this source

Cited by the same report: Hunting Lazarus: Inside the Contagious Interview C2 Infrastructure

Red Asgard lists 8 other indicators in this source. 4 are shown, chosen across types.

• 45.43.11.199 IP address
• 66.235.168.238 IP address
• https://pastebin.com/u/CrackEden1251_WaitsRenee9809 payload URL
• https://pastebin.com/u/KerrWhale2274_KnowNtsc6785 payload URL

All 9 indicators from this source

Cited by the same report: Hunting Lazarus Part IV: Real Blood on the Wire

Red Asgard lists 7 other indicators in this source. 3 are shown, chosen across types.

• 144.172.101.45 IP address
• 144.172.104.117 IP address
• 86.106.85.234 IP address

All 8 indicators from this source