89.213.118.38
89.213.118.38 is an IP address
that one published source reports
in connection with Contagious Interview activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from meow mfer (@meow_mfer).
The report is dated 2026-05-18.
The reporting files it under the persona headhunter705, alongside 10 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.
ip address Contagious Interview RESEARCHER POST
Network
| Kind | proxy or VPN |
|---|---|
| Network | Dominic Scholz trading as ITP-Solutions GmbH & Co. KG |
| Announced by | AS213250 Dominic Scholz trading as ITP-Solutions GmbH & Co. KG |
| Country | Germany |
| Flags | known proxy or VPN |
Source
-
Drawn from "Deep Dive into Active Github Network Running Contagious Interview", an article the researcher published on X in May 2026 covering an investigation running since mid-2025. The article names the same operation under the labels several vendors give it, Contagious Interview and PolinRider and UNC5342 among them, and describes an infection chain that begins with a repository sent during a fake interview and executes when the developer opens the folder in VS Code or Cursor. This operator runs the keylogger side of it. The two npm packages were, at the time of writing, still published and installable, and carry compiled Windows and Linux keyloggers that capture keystrokes system-wide; the article notes both packages ship the identical Linux binary, which is what places them on one build pipeline. The first hash is the Windows binary and the second the Linux one. Captured keystrokes and clipboard contents go to the hook-server2 address, clipboard changes and a victim beacon carrying operating system, hostname and username to the first address, and stolen browser-extension wallet data to the second. A separate post published the day before the article names the npm account that publishes both packages as topnotcher847, with the address recorded here, and reports the Windows binary inside them at 34 of 74 detections on VirusTotal, one vendor naming it as Lazarus tooling. That account and this GitHub operator are two identities in one operation rather than the same handle, which is worth stating because the two names sit beside each other in the reporting.
x.com/meow_mfer/status/2056238427449004537 — meow mfer (@meow_mfer)
Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.
Related indicators
Same persona record: headhunter705
All 10 on the headhunter705 page