151.80.76.66
151.80.76.66 is an IP address
that 2 published sources report
in connection with Contagious Interview activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Chollima Hunter and Amsterdam Technologies.
The earliest of those reports is dated 2026-10-26 and the most recent 2026-11-11.
ip address Contagious Interview CURATED
Network
| Kind | data centre |
|---|---|
| Network | OVH SAS |
| Announced by | AS16276 OVH SAS |
| Country | France |
| Flags | hosting range |
Sources
-
Endpoint telemetry from a developer who downloaded the main-branch archive of togetherlabsinchub/palooza from GitHub, reported to this site in October 2026, shows the project started with node server.js and then a Node.js child process run inline with node -e, carrying a campaign identifier, a numeric key and the C2 address http://151.80.76.64:1224/. That shape, an inline loader calling back to port 1224 and identifying itself to the server, is the BeaverTail first stage of the Contagious Interview campaign, delivered as a coding exercise in a fake job interview. The account name borrows that of Together Labs, Inc., a real company with no part in this; impersonating a real employer is the campaign's usual lure. By 26 October 2026 the account and the repository both returned not found through the GitHub API, and the Wayback Machine holds no capture of either, so the repository is listed as a removed link. Nothing from it was downloaded or run. Maltrail's Lazarus trail list carries 151.80.76.64 on ports 1224 and 3333 (the BeaverTail and InvisibleFerret ports), together with 151.80.76.66 and 151.80.76.67 on the same two ports. All three sit on OVH in Roubaix, rented through the Windows VPS reseller RDP Quick with remote desktop open. Shodan's InternetDB on 26 October 2026 showed a Node.js Express server on 151.80.76.64 port 3333 and on 151.80.76.66 port 1224, so at least two of the three were serving that day.
github.com/stamparm/trails/blob/b258350295e9871463f30ca09a0adcc6e5566021/malware/apt_lazarus.txt — Chollima Hunter -
…51.210.65.37 current 141.94.148.35 historical 141.94.148.39 historical 147.124.212.180 historical 147.124.212.207 historical 151.80.76.66 historical 167.114.215.75 historical 216.250.251.187 historical 216.250.252.245 historical 54.39.43.114 historical 54.39.43.117…
A very contagious interview — Amsterdam Technologies — Amsterdam Technologies
Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.