`91.218.183.174`

91.218.183.174 is an IP address that 4 published sources report in connection with EtherHiding / UNC5342, NullReceiver, Contagious Interview and PolinRider activity, which public reporting attributes to North Korea (DPRK). It is cited here from Chollima Hunter (on-chain observation), SafeDep, OpenSourceMalware and BlueCyber. The earliest of those reports is dated 2026-08-02 and the most recent 2026-10-18.

On-chain links

EtherHiding addresses that pointed malware at this host, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. See the EtherHiding Tracker.

Address	Transaction	Type	Role	Malware family	First written	Last written
`0xa322e5f3d311d3080e6f0121063e9adc2490ef1a`	Etherscan	Wallet, ethereum	resolver wallet	NullReceiver	2026-09-28	2026-10-06

ip address EtherHiding / UNC5342NullReceiverContagious Interview PolinRider CURATED

First seen 2026-08-02 · last seen 2026-10-18

Network

Kind	fixed line
Network	Evoxt Enterprise (Jerng Yue Lee trading as Evoxt Enterprise)
Announced by	AS149440 Evoxt Sdn. Bhd.
Country	United Kingdom

Looked up 2026-10-02 at ip-api.com. A subscriber line, as a person working from home ordinarily has.

Sources

Command-and-control IP decoded from the NullReceiver destination address 0x5bdab7ae5bdab7ae68656c6c6f6970626f742121 that the watchlisted resolver wallet pointed to from 2026-09-28 to 2026-10-06, across 67 transactions. SafeDep's PolinRider report of 30 September 2026 names the same address as the current C2 read from the same wallet. It is recorded as the address the malware resolves to, not as a host this site has observed serving anything.
Ethereum transaction 0x38f67c5ef7c3b017eac85ce8a2dda420921461852e74febda440ce73d482cfef — Chollima Hunter (on-chain observation) · published 2026-09-28 · pulled 2026-10-26
Command-and-control IP decoded from the NullReceiver destination address 0x5bdab7ae5bdab7ae68656c6c6f6970626f742121 that the watchlisted resolver wallet pointed to from 2026-09-28 to 2026-10-06, across 67 transactions. SafeDep's PolinRider report of 30 September 2026 names the same address as the current C2 read from the same wallet. It is recorded as the address the malware resolves to, not as a host this site has observed serving anything.
PolinRider Switches to Ethereum C2 in 30+ Repositories — SafeDep · published 2026-09-30 · pulled 2026-10-26
Command-and-control IP decoded from the NullReceiver destination address 0x5bdab7ae5bdab7ae68656c6c6f6970626f742121 that the watchlisted resolver wallet pointed to from 2026-09-28 to 2026-10-06, across 67 transactions. SafeDep's PolinRider report of 30 September 2026 names the same address as the current C2 read from the same wallet. It is recorded as the address the malware resolves to, not as a host this site has observed serving anything.
NullReceiver's Blank Crypto Transfers Solves the Challenges of EtherHiding — OpenSourceMalware · published 2026-08-02 · pulled 2026-10-26
…text helloipbot!! : 1 // latest 0xa322 heartbeat, block 26089999 2 to: 0x5BDAb7Ae 5BDAb7aE 68656C6C6f6970626F742121 3 91.218.183.174 | 91.218.183.174 | h e l l o i p b o t ! ! The loader gets /0x/cls and /0x/ls with a Sec-V header that carries the marker.…
PolinRider Switches to Ethereum C2 in 30+ Repositories — SafeDep · under “The second Ethereum wallet” · published 2026-09-30 · pulled 2026-10-02
…công: 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a IP C&C: 166.88.134.62 , 23.27.13.135 , 166.88.73.46 , 193.247.144.38 , 166.88.134.75 , 91.218.183.174 , 23.27.13.72 Chuỗi tĩnh: A10-npm3! , helloipbot!! 7.6.…
EtherRAT phát tán qua giả mạo hỗ trợ IT trên Microsoft Teams: Smart contract Ethereum làm cơ chế phân giải C&C — BlueCyber · under “7.5. IoC” · published 2026-10-18 · pulled 2026-10-26
…They are the ASCII text helloipbot!! : // latest 0xa322 heartbeat, block 26089999 to: 0x5BDAb7Ae 5BDAb7aE 68656C6C6f6970626F742121 91.218.183.174 | 91.218.183.174 | h e l l o i p b o t ! ! The loader gets /0x/cls and /0x/ls with a Sec-V header that carries the marker.…
PolinRider Switches to Ethereum C2 in 30+ Repositories — SafeDep · under “The second Ethereum wallet” · published 2026-09-30 · pulled 2026-11-13

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: PolinRider Switches to Ethereum C2 in 30+ Repositories

SafeDep lists 44 other indicators in this source. 7 are shown, chosen across types.

All 45 indicators from this source

Cited by the same report: NullReceiver's Blank Crypto Transfers Solves the Challenges of EtherHiding

OpenSourceMalware lists 15 other indicators in this source. 5 are shown, chosen across types.

All 16 indicators from this source