bitgesell.finance
bitgesell.finance is a domain
that one published source reports
in connection with Contagious Interview activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from meow mfer (@meow_mfer).
The report is dated 2025-08-11.
domain Contagious Interview RESEARCHER POST
Registration
| Registered | 2026-07-20 |
|---|---|
| Registrar | CommuniGal Communication Ltd. |
| Expires | 2027-07-20 |
| Last changed | 2026-08-12 |
| Status | client transfer prohibited |
Source
-
A fake recruiter approached the researcher on LinkedIn while impersonating the Bitgesell project, then sent a take-home coding assignment hosted in a private Bitbucket organisation. The researcher describes the assignment's backend as contacting an external URL on startup and executing whatever code it receives, which is a remote-code-execution backdoor disguised as middleware. The registration dates are the researcher's own evidence for the impersonation: the post states that bitgesell.co was registered on 9 August 2025, the day before the approach, while the project's official site was registered in April 2020. A second domain, bitgesell.finance, appeared a day later with the same hire@ address pattern. The hashes are reproduced from the researcher's own indicator list for the assignment repository.
x.com/meow_mfer/status/1954866701897805865 — meow mfer (@meow_mfer)
Find this indicator in the index, or see every domain this site holds under Domains in the browse listing.