`cloudflareinsights.vercel.app`

cloudflareinsights.vercel.app is a domain that 3 published sources report in connection with Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from Panther Labs and Kieran Miyamoto (kmsec). The earliest of those reports is dated 2026-03-17 and the most recent 2026-04-24.

domain Contagious Interview CURATED

First seen 2026-03-17 · last seen 2026-04-24

Sources

Primary C2 -- config fetch and multipart file upload. OtterCookie C2 domain named to impersonate Cloudflare infrastructure, documented by Panther.
Tracking an OtterCookie Infostealer Campaign Across npm — Panther Labs · published 2026-04-10 · pulled 2026-08-30
…samples, the malware exposed two main behaviors: one function fetched /api/ssh-key , /api/scan-patterns , and /api/block-patterns from cloudflareinsights.vercel.app , then stole ~/.ssh material and any server-selected files; the other recursively searched the working directory for developer secrets such…
Inside DPRK’s npm Malware Factory: 108 Packages & 261 Versions — Panther Labs · under “Cluster F: SSH persistence and Solana/developer key theft” · published 2026-04-24 · pulled 2026-09-02
…SSH (port 22) using ufw . The SSH key is retrieved dynamically from the exfiltration server For npm-builders , the exfiltration server is https://cloudflareinsights.vercel.app The infection chain is invoked by a postinstall script that executes /test.js , which invokes the malicious from_str() function. Here…
Contagious Trader campaign - Coordinated weaponisation of cryptocurrency trading bots by suspected DPRK malware operators | kmsec.uk — Kieran Miyamoto (kmsec) · under “Analysis” · published 2026-03-17 · pulled 2026-09-09

Find this indicator in the index, or see every domain this site holds under Domains in the browse listing.

Related indicators

Cited by the same report: Tracking an OtterCookie Infostealer Campaign Across npm

Panther Labs lists 18 other indicators in this source. 5 are shown, chosen across types.

All 19 indicators from this source

Cited by the same report: Inside DPRK’s npm Malware Factory: 108 Packages & 261 Versions

Panther Labs lists 97 other indicators in this source. 4 are shown, chosen across types.

All 98 indicators from this source

Cited by the same report: Contagious Trader campaign - Coordinated weaponisation of cryptocurrency trading bots by suspected DPRK malware operators | kmsec.uk

Kieran Miyamoto (kmsec) lists 34 other indicators in this source. 3 are shown, chosen across types.

All 35 indicators from this source