`sfrclak.com`

sfrclak.com is a domain that 2 published sources report in connection with Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from Threat Book and N3mes1s. The reports are dated 2026-03-31.

domain Contagious Interview MATCHED IN SOURCE

First seen 2026-03-31 · last seen 2026-03-31

Registration

Registered	2026-03-30
Registrar	NameCheap, Inc.
Expires	2027-03-30
Last changed	2026-03-31
Status	client hold, client transfer prohibited

From the registry’s RDAP record for sfrclak.com, looked up 2026-10-05. A hold means the domain does not resolve, usually because the registrar or registry suspended it.

Sources

…trojan, and that the threat organization behind it is the Lazarus APT Group. Appendix Previously Disclosed IOCs C2 sfrclak.com http://sfrclak.com:8000/6202033 142.11.206.73 Hash Platform SHA256 Linux ( ld.py )…
Lazarus Group Poisons Axios: Inside the npm Supply Chain Attack — Threat Book · under “Previously Disclosed IOCs” · published 2026-03-31 · pulled 2026-09-12
…Shellcode payload 2 (sandbox) — not on VT 9.3 Network IOCs Type Indicator Context Domain sfrclak.com Primary C2 IP 142.11.206.73 C2 server URL http://sfrclak.com:8000/6202033 Payload endpoint Port 8000 (HTTP) C2…
Axios npm Supply Chain Compromise (2026-03-31) — Full RE + Dynamic Analysis + BlueNoroff Attribution — N3mes1s · under “9.3 Network IOCs” · published 2026-03-31 · pulled 2026-10-18

Find this indicator in the index, or see every domain this site holds under Domains in the browse listing.

Related indicators

Cited by the same report: Lazarus Group Poisons Axios: Inside the npm Supply Chain Attack

Threat Book lists 8 other indicators in this source. 7 are shown, chosen across types.

All 9 indicators from this source

Cited by the same report: Axios npm Supply Chain Compromise (2026-03-31) — Full RE + Dynamic Analysis + BlueNoroff Attribution

N3mes1s lists 47 other indicators in this source. 5 are shown, chosen across types.

All 48 indicators from this source