← Remote Workers

144.172.112.106

144.172.112.106 is an IP address that 4 published sources report in connection with Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from Socket, Recorded Future, JPCERT/CC and Gen Digital. The earliest of those reports is dated 2025-10-10 and the most recent 2026-11-09.

ip address Contagious Interview CURATED

First seen 2025-10-10 · last seen 2026-11-09

Network

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

• Direct-IP command-and-control endpoint listed by Socket for the July to October 2025 Contagious Interview npm wave of 338 packages.

  North Korea's Contagious Interview Campaign Escalates: 338 Malicious npm Packages, 50,000 Downloads — Socket · published 2025-10-10 · pulled 2026-09-21

• …— Financial Theft Indicators of Compromise (IOCs) # C2 Endpoints # 135.181.123.177 138.201.50.5 144.172.105.235 144.172.112.106 146.70.253.107 23.127.202.249 23.227.202.244 http://fashdefi.store:6168/defy/v7 https://0927.vercel.app/api/ipcheck…

  North Korea’s Contagious Interview Campaign Escalates: 338 Malicious npm Packages, 50,000 Downloads | Socket — Socket · under “C2 Endpoints #” · published 2025-10-10 · pulled 2026-09-01

• …144.172.102.148 144.172.103.97 144.172.104.113 144.172.105.189 144.172.105.235 144.172.106.7 144.172.106.133 144.172.109.98 144.172.109.155 144.172.112.106 146.70.253.107 147.124.197.138 147.124.212.125 147.124.213.19 147.124.213.232 147.124.214.129 147.124.214.131 147.124.214.237 165.140.85.10…

  PurpleBravo’s Targeting of the IT Software Supply Chain — Recorded Future · under “Appendix B: C2 Servers” · published 2026-01-21 · pulled 2026-09-12

• …5 144.172.102.148 144.172.102.21 144.172.103.97 144.172.104.10 144.172.104.113 144.172.105.189 144.172.105.235 144.172.106.7 144.172.109.98 144.172.112.106 144.172.122.143 144.172.74.108 144.172.74.48 144.172.86.27 144.172.95.226 144.172.96.80 147.124.197.149 147.124.212.146 147.124.212.89 147.…

  Contagious Interview IoCs — JPCERT/CC · published 2025-08-25 · pulled 2026-09-18

• …2025, our system tracking Gamaredon’s Command-and-Control (C2) servers via known Telegram and Telegraph channels blocked an IP address: 144.172.112.106 Four days later, during a routine check, the same server was found hosting an obfuscated version of InvisibleFerret (SHA256:…

  Alliances of convenience: How APTs are beginning to work together — Gen Digital · under “The discovery: a shared digital footprint” · published 2025-11-19 · pulled 2026-10-01

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: North Korea's Contagious Interview Campaign Escalates: 338 Malicious npm Packages, 50,000 Downloads

Socket lists 563 other indicators in this source. 7 are shown, chosen across types.

• 0927.vercel.app domain
• fashdefi.store domain
• dyanisteras15091999cuunn@hotmail.com email address
• https://github.com/jiupaladin GitHub account
• 146.70.253.107 IP address
• router-kit npm package
• https://api.npoint.io/b964566497d98298d32c payload URL

All 564 indicators from this source

Cited by the same report: PurpleBravo’s Targeting of the IT Software Supply Chain

Recorded Future lists 216 other indicators in this source. 5 are shown, chosen across types.

• domin61013@outlook.com email address
• hundredup2023@gmail.com email address
• ricogonzalez1013@gmail.com email address
• 144.172.95.226 IP address
• 147.124.197.138 IP address

All 217 indicators from this source