Chollima Hunter

← Remote Workers

eth-mainnet-alchemy.com

eth-mainnet-alchemy.com is a domain that one published source reports in connection with Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from OpenSourceMalware. The report is dated 2026-01-28.

domain Contagious Interview MATCHED IN SOURCE

First seen 2026-01-28 · last seen 2026-01-28

Registration

Registered2026-01-15
RegistrarHOSTINGER operations, UAB
Expires2027-01-15
Last changed2026-02-25
Statusclient hold, client transfer prohibited

From the registry’s RDAP record for eth-mainnet-alchemy.com, looked up 2026-10-05. A hold means the domain does not resolve, usually because the registrar or registry suspended it.

Source

  • …written up a detailed timeline blog post which you can find HERE Indicators of Compromise (IOCs) Network indicators # C2 Domains eth-mainnet-alchemy.com # C2 URLs http://eth-mainnet-alchemy.com/api/service/token/f71d1d9b2de7d4ebf5f706a4b9cd4eb4 # HTTP Headers x-secret-header: secret…
    DPRK Contagious Interview “Fake Font” Abuses VS Code Tasks | OpenSourceMalware — OpenSourceMalware · under “Network indicators” · published 2026-01-28 · pulled 2026-09-12

Find this indicator in the index, or see every domain this site holds under Domains in the browse listing.

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. See the sourcing methodology.