`ngrok-free.vercel.app`

ngrok-free.vercel.app is a domain that 3 published sources report in connection with Contagious Interview and IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from Socket, NKInternet and Anonhaven. The earliest of those reports is dated 2026-04-07 and the most recent 2026-04-08.

domain Contagious Interview IT Worker Fraud CURATED

First seen 2026-04-07 · last seen 2026-04-08

Sources

Command-and-control or payload-staging host for the April 2026 cross-ecosystem Contagious Interview wave, reported by Socket.
North Korea's Contagious Interview Campaign Spreads Across 5 Ecosystems, Delivering Staged RAT Payloads — Socket · published 2026-04-07 · pulled 2026-09-21
…dev-log-core 1.0.0–1.0.5 aokisasakidev1 New Payload host, all versions malicious C2 infrastructure Domain Active Notes ngrok-free.vercel.app Jan 29 First C2, now rotated logkit.vercel.app Feb 3 Second C2, now rotated logkit-tau.vercel.app Mar 16–now Active as of publication…
npm Malware, Fake Devs, and Deepfake Videos: These Are A Few of My Favorite DPRK Things | North Korean Internet — NKInternet · under “C2 infrastructure” · published 2026-04-07 · pulled 2026-08-30
…Their infrastructure also varies across versions, including ngrok-free.vercel.app , logkit.onrender.com , and logkit-tau.vercel.app .…
North Korea’s Contagious Interview Campaign Spreads Across 5 Ecosystems, Delivering Staged RAT Payloads | Socket — Socket · under “The npm Packages Use a Different Loader #” · published 2026-04-07 · pulled 2026-09-12
…of compromise Type Indicator C2 / staging domain apachelicense.vercel.app C2 / staging domain ngrok-free.vercel.app C2 / staging domain logkit.onrender.com C2 / staging domain logkit-tau.vercel.app C2 IP (Windows variant)…
Contagious Interview Hits npm, PyPI, Go, Rust, PHP — Anonhaven · under “Indicators of compromise” · published 2026-04-08 · pulled 2026-09-18

Find this indicator in the index, or see every domain this site holds under Domains in the browse listing.

Related indicators

Cited by the same report: North Korea's Contagious Interview Campaign Spreads Across 5 Ecosystems, Delivering Staged RAT Payloads

Socket lists 27 other indicators in this source. 7 are shown, chosen across types.

All 28 indicators from this source

Cited by the same report: npm Malware, Fake Devs, and Deepfake Videos: These Are A Few of My Favorite DPRK Things | North Korean Internet

NKInternet lists 31 other indicators in this source. 5 are shown, chosen across types.

All 32 indicators from this source