Chollima Hunter

← Remote Workers

ip-check-server.vercel.app

ip-check-server.vercel.app is a domain that 2 published sources report in connection with Contagious Interview and IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from Socket and GitLab Threat Intelligence. The earliest of those reports is dated 2025-06-25 and the most recent 2026-02-19.

domain Contagious InterviewIT Worker Fraud CURATED

First seen 2025-06-25 · last seen 2026-02-19

Sources

  • C2/exfiltration endpoint for the HexEval Loader wave of Contagious Interview npm packages, which deploys BeaverTail and InvisibleFerret.
    North Korean Contagious Interview Campaign Drops 35 New Malicious npm Packages — Socket · published 2025-06-25 · pulled 2026-08-30

  • Nearby text:

    …https://ip-api-test.vercel.app/api/ip-check-encrypted/3aeb34a38 url malware N/A N/A JavaScript malware dropper URL Year in Review https://ip-check-server.vercel.app/api/ip-check-encrypted/3aeb34a37 url malware N/A N/A JavaScript malware dropper URL Year in Review https://jsonkeeper.com/b/4NAKK url…
    GitLab Threat Intelligence Team reveals North Korean tradecraft — GitLab Threat Intelligence · under “Appendix 2: Indicators of Compromise” · published 2026-02-19 · pulled 2026-09-01

  • Nearby text:

    …https://bitbucket.org/zoro-workspace/ Command and Control (C2) Endpoints # https://log-server-lovat.vercel.app/api/ipcheck/703 https://ip-check-server.vercel.app/api/ip-check/208 https://ip-check-api.vercel.app/api/ipcheck/703 172.86.80.145 SHA256 Hashes #…
    Another Wave: North Korean Contagious Interview Campaign Drops 35 New Malicious npm Packages | Socket — Socket · under “Command and Control (C2) Endpoints #” · published 2025-06-25 · pulled 2026-09-12

Find this indicator in the index, or see every domain this site holds under Domains in the browse listing.

Related indicators

Cited by the same report: North Korean Contagious Interview Campaign Drops 35 New Malicious npm Packages

Socket lists 59 other indicators in this source. 7 are shown, chosen across types.

All 60 indicators from this source

Cited by the same report: GitLab Threat Intelligence Team reveals North Korean tradecraft

GitLab Threat Intelligence lists 733 other indicators in this source. 5 are shown, chosen across types.

All 734 indicators from this source

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. See the sourcing methodology.