ipregionchecker.org
ipregionchecker.org is a domain
that one published source reports
in connection with Contagious Interview activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Chollima Hunter.
The report is dated 2026-10-27.
domain Contagious Interview CURATED
Registration
| Registered | 2026-05-26 |
|---|---|
| Registrar | Name.com, Inc. |
| Expires | 2027-05-26 |
| Last changed | 2026-08-12 |
| Status | client transfer prohibited |
Source
-
Found on 27 October 2026 by searching GitHub code for the loader that bryanchriswhite's dev-trap-dossiers documents as the realfraction generation of the Contagious Interview campaign: a backend file that holds a base64-encoded URL ending /api/ip-check-encrypted/<id>, posts the whole of process.env to it with the header x-secret-header: secret, and runs the reply with new Function("require", ...). Each of the three repositories below carries that loader, read as text and never run. Qevoratrix-live-coding is a GitHub organization created on 20 October 2026 that the same day published six repositories named for languages (react, go, rust, java, solidity, node), the shape of a live-coding interview exercise. In react, backend/src/services/errorHandler.service.config.js decodes to https://www.jitnad.lol/api/ip-check-encrypted/3aeb34a39; the file's only commit is dated 3 September 2026 and attributed to a real developer, whose history the repository copies. stockx-fi, an organization created on 3 August 2026, holds stockx_v1, whose backend/src/compliance/complianceService.js decodes to https://www.ipregionchecker.org/api/ip-check-encrypted/3aeb34a32. 0xbrentfi, a user account created on 21 February 2026 and displaying the name Brent Phelps, holds StockX_PoC_1.03 with the same file decoding to https://www.ipregionchecker.org/api/ip-check-encrypted/3aeb34a37; dev-trap-dossiers already lists that account among the realfraction repositories, and Maltrail's Lazarus trail list carries ipregionchecker.org. The StockX proof-of-concept is the lure that write-up describes, and its first C2 was ipregionchecker.com. jitnad.lol was registered through Dynadot on 23 October 2026, the day the loader was pushed to the repository, and appears in no published source found on 27 October 2026. The same search found jamesm-dev/NitroGem, a neutralized copy of the NitroGem trading-bot lure published for study, whose report gives the original's stage-one C2 as https://locate-my-ip.vercel.app/api/ip-check-encrypted/3aeb34a31; dev-trap-dossiers lists the original, TechByteX/NitroGem, in the cluster. The study copy itself is not filed. Not carried: the commit authors of all three repositories are real developers (one at Uniswap) whose commit history was copied into the lure, the usual way these repositories borrow credibility.
github.com/stockx-fi/stockx_v1/blob/main/backend/src/compliance/complianceService.js — Chollima Hunter
Find this indicator in the index, or see every domain this site holds under Domains in the browse listing.