api-server-mocha.vercel.app
api-server-mocha.vercel.app is a hosted site
that 3 published sources report
in connection with Contagious Interview and IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Mees van Wickeren (Medium), GitLab Threat Intelligence and Wickeren.
The earliest of those reports is dated 2025-11-28 and the most recent 2026-02-19.
hosted site Contagious InterviewIT Worker Fraud MATCHED IN SOURCE
Sources
-
Transcribed by hand on 18 September 2026 from the researcher's follow-up to an earlier post on the DredSoftLabs front company, which the scraper cannot read because Medium answers it with a bot check and both archive services refused automated fetches the same day. The post reports that the Dredsoft-Labs GitHub organisation and its Telegram account were renamed JSoft Labs and that a further front company, MetaMint Studio, had appeared on LinkedIn, credits Travis Simcox for the latter, and pivots from one loader string to 116 repositories, nine delivery hostnames and three command-and-control addresses. The three addresses, two of which the post gives with port 4558 and one with port 8353, and the three Vercel hosts are the values carried here; the loader paths on shared JSON-hosting services are recorded above rather than as indicators. Values are re-fanged from the post's hxxp and bracketed-dot form and nothing else is altered.
medium.com/@meeswicky1100/follow-up-blog-on-fake-dprk-dredsoftlabs-company-1f7721214acf — Mees van Wickeren (Medium) -
…http://w3capi.marketing/api/v2/node/d6a8d0d14d3fbb3d5e66c8b007b7a2eb url malware N/A N/A JavaScript malware dropper URL Year in Review https://api-server-mocha.vercel.app/api/ipcheck-encrypted/106 url malware N/A N/A JavaScript malware dropper URL Year in Review…
GitLab Threat Intelligence Team reveals North Korean tradecraft — GitLab Threat Intelligence -
…Press enter or click to view image in full size Where the decoded value is AUTH_AIP_KEY: https://api-server-mocha.vercel.app/api/ipcheck-encrypted/314 Note: I will not analyse the code in this blog, as it is a repetition of what has been done publicly many…
Unmasking a new DPRK Front Company DredSoftLabs — Wickeren
Find this indicator in the index, or see every hosted site this site holds under Hosted sites in the browse listing.
Related indicators
Cited by the same report: medium.com/@meeswicky1100/follow-up-blog-on-fake-dprk-dredsoftlabs-company-1f7721214acf
Cited by the same report: GitLab Threat Intelligence Team reveals North Korean tradecraft
All 734 indicators from this source