`146.70.253.107`

146.70.253.107 is an IP address that 6 published sources report in connection with Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from Socket, Ossprey, NVISO, Red Asgard, Recorded Future and JPCERT/CC. The earliest of those reports is dated 2025-10-10 and the most recent 2026-11-09.

ip address Contagious Interview CURATED

First seen 2025-10-10 · last seen 2026-11-09

Network

Kind	proxy or VPN
Network	M247 Europe SRL (M247 Ltd Paris)
Announced by	AS9009 M247 Europe SRL
Country	France
Flags	hosting range, known proxy or VPN

Looked up 2026-09-21 at ip-api.com. This range is classed as a proxy or VPN; it does not show who used it.

Sources

Direct-IP command-and-control endpoint listed by Socket for the July to October 2025 Contagious Interview npm wave of 338 packages.
North Korea's Contagious Interview Campaign Escalates: 338 Malicious npm Packages, 50,000 Downloads — Socket · published 2025-10-10 · pulled 2026-09-21
…Theft Indicators of Compromise (IOCs) # C2 Endpoints # 135.181.123.177 138.201.50.5 144.172.105.235 144.172.112.106 146.70.253.107 23.127.202.249 23.227.202.244 http://fashdefi.store:6168/defy/v7 https://0927.vercel.app/api/ipcheck…
North Korea’s Contagious Interview Campaign Escalates: 338 Malicious npm Packages, 50,000 Downloads | Socket — Socket · under “C2 Endpoints #” · published 2025-10-10 · pulled 2026-09-01
…Five of ours appear on it: 23.227.202.244 , 146.70.253.107 , 45.61.150.31 , 88.218.0.78 and 5.253.43.122 .…
Uncovering a 300+ Package DPRK Contagious Interview Campaign — Ossprey · under “The shape of the network” · published 2026-07-02 · pulled 2026-09-02
…fetches and executes the next stage which is InvisibleFerret : http://146.70.253.107:1224/pdown (ZIP file with Python) http://146.70.253.107:1224/client/99/81 (Malicious Python script – InvisibleFerret) Interestingly, the campaign used here specifically mentions it has been…
Contagious Interview Actors Now Utilize JSON Storage Services for Malware Delivery — NVISO · under “Malware Delivery Through JSON Storage Services” · published 2025-11-13 · pulled 2026-09-12
…browser stealer, persistent access via AnyDesk backdoor. Act 5: Breaking Into the Operator Panel Wave 12: CVE-2024-4577 The C2 at 146.70.253.107 runs XAMPP with Apache 2.4.58 and PHP 8.1.25 on Windows Server 2022.…
Hunting Lazarus Part IV: Real Blood on the Wire — Red Asgard · under “Wave 12: CVE-2024-4577” · published 2026-02-03 · pulled 2026-09-12
…144.172.103.97 144.172.104.113 144.172.105.189 144.172.105.235 144.172.106.7 144.172.106.133 144.172.109.98 144.172.109.155 144.172.112.106 146.70.253.107 147.124.197.138 147.124.212.125 147.124.213.19 147.124.213.232 147.124.214.129 147.124.214.131 147.124.214.237 165.140.85.105 165.140.86.15…
PurpleBravo’s Targeting of the IT Software Supply Chain — Recorded Future · under “Appendix B: C2 Servers” · published 2026-01-21 · pulled 2026-09-12
…94.232.247.192 95.164.17.24 95.164.33.66 95.164.45.239 95.217.124.253 angeloperonline.online lianxinxiao.com sageskills-uk.com www.dalas.nl 146.70.253.107 141.98.168.79 69.10.53.86 60.93.32.117 103.35.188.237 23.227.203.204 217.148.142.113 0.10.51.212 45.61.151.174 23.227.203.192 23.227.202.51…
Contagious Interview IoCs — JPCERT/CC · published 2025-08-25 · pulled 2026-09-18

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: North Korea's Contagious Interview Campaign Escalates: 338 Malicious npm Packages, 50,000 Downloads

Socket lists 563 other indicators in this source. 7 are shown, chosen across types.

All 564 indicators from this source

Cited by the same report: Uncovering a 300+ Package DPRK Contagious Interview Campaign

Ossprey lists 14 other indicators in this source. 5 are shown, chosen across types.

All 15 indicators from this source