← Remote Workers

188.40.64.61

188.40.64.61 is an IP address that one published source reports in connection with Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from Elastic Security Labs. The report is dated 2026-07-18.

ip address Contagious Interview MATCHED IN SOURCE

First seen 2026-07-18 · last seen 2026-07-18

Network

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Source

• …Socket.IO RAT C2 file.rightwidth.dev domain-name Windows second-stage download host 195.26.248.212 ipv4 OTTERCOOKIE C2 Server 188.40.64.61 ipv4 OTTERCOOKIE C2 Server References The following were referenced throughout the above research: Contagious Interview malware…

  New North Korean campaign uses fake coding interviews to steal developer credentials — Elastic Security Labs · under “Observables” · published 2026-07-18 · pulled 2026-09-01

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: New North Korean campaign uses fake coding interviews to steal developer credentials

Elastic Security Labs lists 10 other indicators in this source.

• 3e6360f83a95540aa2176d279ca4694513afb1e5116a7ffe591c6b5bcf3b9c3c file hash
• 4e7639045b4a64de60bfb6312951a5c3dffbd3fb04b84837663242ed27f09864 file hash
• 54bf36910d81ab516037cb3d69d7c85190f90aa0da9e58617799c1fc738dc5a9 file hash
• 8e571d58794b9b44ae53c2c67bedef72c500e8adbb80aab7a5c263adcba55b1e file hash
• 96357529d17c4690826d5d4c74deac51743a5388733b3f04004d898f0635ef20 file hash
• 9df01d242ef46adfedf8c35cb7cc67b1d27d7dc4a1ce74ab32e984090d579886 file hash
• c5aed4c063d4970a03250778da8041da9e0c83d8f22d2f1994da0ad72567ebd9 file hash
• cc97517f80f567977300450de11e9a0be53f52657525a20b1091c99fe9e45730 file hash
• fb94b2caee2c40635448a98ba0118421e19a400e74ccff73315f8fa42351f53f file hash
• 195.26.248.212 IP address