136.0.7.231
136.0.7.231 is an IP address
that 3 published sources report
in connection with EtherHiding / UNC5342 and Contagious Interview activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Chollima Hunter (on-chain observation) and Ransom-ISAC.
The earliest of those reports is dated 2026-09-25 and the most recent 2026-10-08.
On-chain links
| Address | Transaction | Type | Role | Malware family | First written | Last written |
|---|---|---|---|---|---|---|
0x33ff3edaf55a8e03dcbc7cb40d498a49cd499891 |
Etherscan | Wallet, ethereum | resolver wallet | DEV#POPPER.js | 2026-10-07 | 2026-10-12 |
ip address EtherHiding / UNC5342Contagious Interview CURATED
Network
| Kind | data centre |
|---|---|
| Network | Ace Data Centers II |
| Announced by | AS149440 Evoxt Sdn. Bhd. |
| Country | United States |
| Flags | hosting range |
Sources
-
Command-and-control IP decoded from two recipient addresses the watchlisted XCTDH signal wallet 0x33ff3edaf55a8e03dcbc7cb40d498a49cd499891 paid: as the secondary endpoint, on port 80, of 0x67d5f82d01bb880007e7005000ff5c60b6c34b5a from 2026-10-07, and as both endpoints of 0x880007e701bb880007e7005000ffd4bc60cb30fa from 2026-10-08, which the wallet was still paying on 2026-10-11. Read with the encoding Ransom-ISAC published for this wallet: the first four bytes are the IP and the next two the port. This is an on-chain observation by this site, made after the report was published, and it is recorded as the address the implant is pointed at, not as a host this site has observed serving anything.
Ethereum transaction 0x501a178d4a4b132e8cc84f2c64ea17488cb4ed2338b0b4cc75ec8ce1590d28ea — Chollima Hunter (on-chain observation) -
Command-and-control IP decoded from two recipient addresses the watchlisted XCTDH signal wallet 0x33ff3edaf55a8e03dcbc7cb40d498a49cd499891 paid: as the secondary endpoint, on port 80, of 0x67d5f82d01bb880007e7005000ff5c60b6c34b5a from 2026-10-07, and as both endpoints of 0x880007e701bb880007e7005000ffd4bc60cb30fa from 2026-10-08, which the wallet was still paying on 2026-10-11. Read with the encoding Ransom-ISAC published for this wallet: the first four bytes are the IP and the next two the port. This is an on-chain observation by this site, made after the report was published, and it is recorded as the address the implant is pointed at, not as a host this site has observed serving anything.
Ethereum transaction 0x9fecdd235d0b71e07b8e9702a6e73ec85970d5be8084ec6931bef3d90bbc8937 — Chollima Hunter (on-chain observation) -
Command-and-control IP decoded from two recipient addresses the watchlisted XCTDH signal wallet 0x33ff3edaf55a8e03dcbc7cb40d498a49cd499891 paid: as the secondary endpoint, on port 80, of 0x67d5f82d01bb880007e7005000ff5c60b6c34b5a from 2026-10-07, and as both endpoints of 0x880007e701bb880007e7005000ffd4bc60cb30fa from 2026-10-08, which the wallet was still paying on 2026-10-11. Read with the encoding Ransom-ISAC published for this wallet: the first four bytes are the IP and the next two the port. This is an on-chain observation by this site, made after the report was published, and it is recorded as the address the implant is pointed at, not as a host this site has observed serving anything.
XCTDH Adopts Hash Hiding — Ransom-ISAC
Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.