qorexalabs.com
qorexalabs.com is a domain
that one published source reports
in connection with Moonstone Sleet activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from bbsz (@blackbigswan).
The report is dated 2026-11-06.
domain Moonstone Sleet RESEARCHER POST
Registration
| Registered | 2026-01-12 |
|---|---|
| Registrar | NameCheap, Inc. |
| Expires | 2027-01-12 |
| Last changed | 2026-02-04 |
| Status | client transfer prohibited |
Source
-
The researcher quotes a post by Doug Madory of Kentik advising networks to de-peer from Qorexa Labs (AS402425), which Madory says is believed to be a front for the North Korean group Moonstone Sleet and has engaged in BGP hijacking and traffic manipulation in 2026, and adds the company's GitHub account and the address it commits under, describing the operation as an IT-worker one. The attached images show the Qorexa Labs site offering a play-to-earn tank game called Chaintanks, a QorexaSwap and a QorexaWallet, and the account's single repository, chaintanks, a backend template created on 17 March 2026; the tank-game product matches the lure reported for Moonstone Sleet. The domain is carried because the address is on it. In a reply the researcher adds a capture of a Qorexa Labs LLC job listing for a Unity game engineer (Manchester, 24 February 2026) and a summary of a CNCERT report of 20 October 2026 accusing AS402425 of DNS tampering. The attribution is Madory's and the researcher's, not this site's. Read on 12 November 2026 with all three replies.
x.com/blackbigswan/status/2118849802767311052 — bbsz (@blackbigswan)
Find this indicator in the index, or see every domain this site holds under Domains in the browse listing.