← Remote Workers

147.124.197.138

147.124.197.138 is an IP address that 2 published sources report in connection with Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from NVISO and Recorded Future. The earliest of those reports is dated 2025-11-13 and the most recent 2026-10-18.

ip address Contagious Interview MATCHED IN SOURCE

First seen 2025-11-13 · last seen 2026-10-18

Network

Looked up 2026-09-21 at ip-api.com. A subscriber line, as a person working from home ordinarily has.

Sources

• …& Control servers 107.189.25.109 144.172.100.142 144.172.103.97 144.172.95.226 144.172.97.7 146.70.253.10 146.70.253.107 147.124.197.138 147.124.197.149 147.124.212.146 147.124.212.89 147.124.214.129 147.124.214.131 147.124.214.237 165.140.86.227 172.86.84.38…

  Contagious Interview Actors Now Utilize JSON Storage Services for Malware Delivery — NVISO · under “Indicators of Compromise (IOCs)” · published 2025-11-13 · pulled 2026-09-12

• …144.172.104.113 144.172.105.189 144.172.105.235 144.172.106.7 144.172.106.133 144.172.109.98 144.172.109.155 144.172.112.106 146.70.253.107 147.124.197.138 147.124.212.125 147.124.213.19 147.124.213.232 147.124.214.129 147.124.214.131 147.124.214.237 165.140.85.105 165.140.86.154 165.140.86.160…

  PurpleBravo’s Targeting of the IT Software Supply Chain — Recorded Future · under “Appendix B: C2 Servers” · published 2026-01-21 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Contagious Interview Actors Now Utilize JSON Storage Services for Malware Delivery

NVISO lists 67 other indicators in this source. 7 are shown, chosen across types.

• magalhaesbruno236@gmail.com email address
• reichenausteve@gmail.com email address
• https://github.com/jackhill2765-gif GitHub account
• https://github.com/meta-stake GitHub account
• https://gitlab.com/real-world-assest-tokenization GitLab account
• 147.124.197.149 IP address
• https://jsonkeeper.com/b/FM8D6 payload URL

All 68 indicators from this source

Cited by the same report: PurpleBravo’s Targeting of the IT Software Supply Chain

Recorded Future lists 216 other indicators in this source. 5 are shown, chosen across types.

• domin61013@outlook.com email address
• ricogonzalez1013@gmail.com email address
• techsavvy001013@outlook.com email address
• 147.124.213.19 IP address
• 147.124.214.131 IP address

All 217 indicators from this source