104.194.153.144
104.194.153.144 is an IP address
that 2 published sources report
in connection with Contagious Interview activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Will Thomas (@BushidoToken) and Moonlock.
The earliest of those reports is dated 2026-08-12 and the most recent 2026-08-14.
ip address Contagious Interview MATCHED IN SOURCE
Network
| Kind | data centre |
|---|---|
| Network | RouterHosting LLC |
| Announced by | AS14956 RouterHosting LLC |
| Country | Singapore |
| Flags | hosting range |
Sources
-
A reply to https://x.com/unpacker/status/2087145269020561711 giving further addresses that match the same three-port OtterCookie query in the researcher's own telemetry. Like the hosts in the post it answers, these are fingerprint matches.
x.com/BushidoToken/status/2087454988414980358 — Will Thomas (@BushidoToken) -
…more 2 1 3 426 Moonlock Lab @moonlock_lab Aug 14 IOCs 🧙 githelper.store 104.194.153.144 (ports 8085, 8086, 8087) HMAC secret:…
DPRK's Contagious Interview campaign is still running — Moonlock -
…Show more 2 1 3 433 Moonlock Lab @moonlock_lab Aug 14 IOCs 🧙 githelper.store 104.194.153.144 (ports 8085, 8086, 8087) HMAC secret:…
DPRK's Contagious Interview campaign is still running — Moonlock -
…1 1 4 282 Moonlock Lab @moonlock_lab Aug 14 6/ The payload spawns 3 workers, all beaconing to 104.194.153.144. Worker 1 hits macOS: → Calls security find-generic-password -w -s "Chrome Safe Storage" to pull the Keychain-derived AES key → Decrypts…
DPRK's Contagious Interview campaign is still running — Moonlock
Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.