ip-check-api.vercel.app
ip-check-api.vercel.app is a domain
that 3 published sources report
in connection with Contagious Interview and Lazarus Group activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Socket and bryanchriswhite (dev-trap-dossiers).
The earliest of those reports is dated 2025-04-04 and the most recent 2026-05-18.
domain Contagious InterviewLazarus Group CURATED
Sources
-
C2/exfiltration endpoint for the HexEval Loader wave of Contagious Interview npm packages, which deploys BeaverTail and InvisibleFerret.
North Korean Contagious Interview Campaign Drops 35 New Malicious npm Packages — Socket -
…The former references the endpoint ip-api-server.vercel.app/api/ipcheck/703 , while the latter uses ip-check-api.vercel.app/api/ipcheck/703 .…
Lazarus Expands Malicious npm Campaign: 11 New Packages Add Malware Loaders and Bitbucket Payloads | Socket — Socket -
…C2 hosts: `ipregionchecker.com` (registrar-frozen), `isillegalregion.com` (Vercel; live), `cookie-xi-seven.vercel.app` and `ip-check-api.vercel.app` (both DEPLOYMENT_DISABLED). | Repository | Lure theme | Generation | Repo signals verified | |---|---|---|---| |…
bryanchriswhite/dev-trap-dossiers — README — bryanchriswhite (dev-trap-dossiers)
Find this indicator in the index, or see every domain this site holds under Domains in the browse listing.
Related indicators
Cited by the same report: North Korean Contagious Interview Campaign Drops 35 New Malicious npm Packages
All 60 indicators from this source
Cited by the same report: Lazarus Expands Malicious npm Campaign: 11 New Packages Add Malware Loaders and Bitbucket Payloads | Socket
All 17 indicators from this source