Remote Workers
Indicators from DPRK remote IT-worker schemes and the "Contagious Interview" lure campaigns. Every entry cites the public record it came from.
See also Personas, Named IT Workers and Red Flags.
Download these results
| Indicator | Type | Persona and cluster | Report date | Sources |
|---|
| Indicator | Type | Persona and cluster | Report date | Sources |
|---|---|---|---|---|
103.231.75.101 proxy or VPN |
ip address MATCHED IN SOURCE | Lazarus Group Kimsuky APT37 Konni Contagious Interview | 2025-09-25 | 4 |
141.98.168.79 data centre |
ip address MATCHED IN SOURCE | Lazarus Group Kimsuky APT37 Konni Contagious Interview | 2025-08-25 | 3 |
192.64.119.25 data centre |
ip address MATCHED IN SOURCE | Lazarus Group Kimsuky APT37 Konni Contagious Interview | 2025-10-13 | 2 |
198.54.116.177 data centre |
ip address MATCHED IN SOURCE | Lazarus Group Kimsuky APT37 Konni Contagious Interview | 2025-10-13 | 2 |
198.54.119.94 data centre |
ip address MATCHED IN SOURCE | Lazarus Group Kimsuky APT37 Konni Contagious Interview | 2025-10-13 | 2 |
199.188.200.147 data centre |
ip address MATCHED IN SOURCE | Lazarus Group Kimsuky APT37 Konni Contagious Interview | 2025-09-25 | 4 |
260120.vercel.app |
domain CURATED | PolinRider Contagious Interview | 2026-04-12 | 2 |
45.159.248.110 data centre |
ip address MATCHED IN SOURCE | Lazarus Group Kimsuky APT37 Konni Contagious Interview | 2025-08-25 | 5 |
45.89.53.54 data centre |
ip address MATCHED IN SOURCE | Lazarus Group Kimsuky APT37 Konni Contagious Interview | 2025-08-25 | 3 |
69.10.53.86 data centre |
ip address MATCHED IN SOURCE | Lazarus Group Kimsuky APT37 Konni Contagious Interview | 2025-08-25 | 3 |
AS20485 |
asn MATCHED IN SOURCE | IT Worker Fraud Kimsuky DPRK (cluster unattributed) | 2018-03-16 | 17 |
backendeng0417@gmail.com |
email address MATCHED IN SOURCE | IT Worker Fraud Kimsuky | 2025-08-19 | 3 |
balsinyar@gmail.com |
email address MATCHED IN SOURCE | balsinyar IT Worker Fraud Kimsuky | 2025-05-17 | 4 |
cdf296d7404bd6193514284f021bfa54 |
file hash MATCHED IN SOURCE | Lazarus Group Kimsuky APT37 Konni Contagious Interview | 2025-10-13 | 1 |
cryptocooker301@gmail.com |
email address MATCHED IN SOURCE | IT Worker Fraud | 2026-10-12 recorded | 1 |
default-configuration.vercel.app |
domain CURATED | PolinRider Contagious Interview | 2026-04-12 | 2 |
f277110800d861faa6a737c8d668d297 |
file hash MATCHED IN SOURCE | Lazarus Group Kimsuky APT37 Konni Contagious Interview | 2025-10-13 | 1 |
fashioncstar2019@outlook.com |
email address MATCHED IN SOURCE | IT Worker Fraud | 2026-10-12 recorded | 1 |
felix44291@gmail.com |
email address MATCHED IN SOURCE | IT Worker Fraud Kimsuky | 2025-08-19 | 3 |
fujinojuzo@gmail.com |
email address MATCHED IN SOURCE | IT Worker Fraud Kimsuky | 2025-08-19 | 3 |
hellomooncity@gmail.com |
email address MATCHED IN SOURCE | IT Worker Fraud | 2025-10-01 | 2 |
henrycampbell1225@gmail.com |
email address CURATED | rarosem IT Worker Fraud | 2025-08-10 | 5 |
https://github.com/0xalberto live |
github profile CURATED | KGJ IT Worker Fraud | 2024-11-16 | 2 |
https://github.com/0xopsdev removed |
github profile MATCHED IN SOURCE | IT Worker Fraud | 2025-06-19 | 3 |
https://github.com/2enology live |
github profile MATCHED IN SOURCE | IT Worker Fraud | 2025-08-26 | 2 |
https://github.com/cornel-cp live |
github profile MATCHED IN SOURCE | IT Worker Fraud | 2025-10-01 | 2 |
https://github.com/crypto-cooker |
github profile MATCHED IN SOURCE | IT Worker Fraud | 2026-10-12 recorded | 1 |
https://github.com/dappboris-dev removed |
github profile MATCHED IN SOURCE | Boris Anderson IT Worker Fraud | 2025-08-26 | 2 |
https://github.com/forest410 live |
github profile MATCHED IN SOURCE | IT Worker Fraud | 2025-07-22 | 2 |
https://github.com/hccee live |
github profile CURATED | rarosem IT Worker Fraud | 2025-02-16 GitHub created | 2 |
https://github.com/husreo removed |
github profile MATCHED IN SOURCE | Boris Anderson IT Worker Fraud | 2025-08-26 | 2 |
https://github.com/hyperbuildx removed |
github profile MATCHED IN SOURCE | IT Worker Fraud | 2025-10-01 | 2 |
https://github.com/justshiftjk removed |
github profile MATCHED IN SOURCE | IT Worker Fraud | 2025-10-01 | 2 |
https://github.com/m4rcu5o removed |
github profile MATCHED IN SOURCE | m4rcu5o IT Worker Fraud | 2025-08-26 | 3 |
https://github.com/mooncitydev |
github profile MATCHED IN SOURCE | IT Worker Fraud | 2026-10-12 recorded | 1 |
https://github.com/mutantrolls |
github profile MATCHED IN SOURCE | IT Worker Fraud | 2026-10-12 recorded | 1 |
https://github.com/ovbjs |
github profile MATCHED IN SOURCE | IT Worker Fraud | 2026-10-12 recorded | 1 |
https://github.com/sea-sol |
github profile MATCHED IN SOURCE | IT Worker Fraud | 2026-10-12 recorded | 1 |
https://github.com/soladify removed |
github profile MATCHED IN SOURCE | IT Worker Fraud | 2025-06-19 | 2 |
https://github.com/taprwhiz removed |
github profile MATCHED IN SOURCE | whisdev IT Worker Fraud | 2025-08-26 | 2 |
https://github.com/tera-star |
github profile MATCHED IN SOURCE | IT Worker Fraud | 2026-10-12 recorded | 1 |
https://github.com/tru3bliss removed |
github profile MATCHED IN SOURCE | IT Worker Fraud | 2025-04-20 | 2 |
https://github.com/whisdev live |
github profile MATCHED IN SOURCE | whisdev IT Worker Fraud | 2025-08-26 | 2 |
https://medium.com/@sakelejames |
medium account MATCHED IN SOURCE | whisdev IT Worker Fraud | 2025-08-26 | 2 |
https://t.me/blategold live |
telegram account MATCHED IN SOURCE | IT Worker Fraud | 2026-10-12 recorded | 1 |
https://t.me/coinbit25 live |
telegram account MATCHED IN SOURCE | IT Worker Fraud | 2026-10-12 recorded | 1 |
https://t.me/da1asin live |
telegram account MATCHED IN SOURCE | IT Worker Fraud | 2026-10-12 recorded | 1 |
https://t.me/idiorusty live |
telegram account MATCHED IN SOURCE | m4rcu5o IT Worker Fraud | 2025-08-26 | 3 |
https://t.me/mutantrolls live |
telegram account MATCHED IN SOURCE | IT Worker Fraud | 2026-10-12 recorded | 1 |
https://t.me/oliparker000 live |
telegram account MATCHED IN SOURCE | IT Worker Fraud | 2026-10-12 recorded | 1 |