checkmyip-mu.vercel.app
checkmyip-mu.vercel.app is a hosted site
that one published source reports
in connection with Contagious Interview activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from meow mfer (@meow_mfer).
The report is dated 2026-05-18.
hosted site Contagious Interview RESEARCHER POST
Source
-
Drawn from "Deep Dive into Active Github Network Running Contagious Interview", an article the researcher published on X in May 2026 covering an investigation running since mid-2025. The article names the same operation under the labels several vendors give it, Contagious Interview and PolinRider and UNC5342 among them, and describes an infection chain that begins with a repository sent during a fake interview and executes when the developer opens the folder in VS Code or Cursor. The first four are what the article calls the polymorphic servers: each request returns a freshly generated obfuscated JavaScript payload of about 3.5 megabytes, with a different hash, different obfuscation seeds and different encryption keys every time. That is the reason no payload hash is recorded for this part of the chain, and why the hosts are the indicator. The fifth is a separate anti-analysis step: it deliberately returns an HTTP error whose body the malware then evaluates as code. These are delivery infrastructure shared across the campaign rather than any one operator's accounts, so no persona is attached.
x.com/meow_mfer/status/2056238427449004537 — meow mfer (@meow_mfer)
Find this indicator in the index, or see every hosted site this site holds under Hosted sites in the browse listing.