`166.88.134.75`

166.88.134.75 is an IP address that 6 published sources report in connection with EtherHiding / UNC5342, NullReceiver, Contagious Interview and PolinRider activity, which public reporting attributes to North Korea (DPRK). It is cited here from Chollima Hunter (on-chain observation), OpenSourceMalware, SlowMist, SafeDep, BlueCyber and OxSecurity. The earliest of those reports is dated 2026-08-02 and the most recent 2026-11-04.

On-chain links

EtherHiding addresses that pointed malware at this host, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. See the EtherHiding Tracker.

Address	Transaction	Type	Role	Malware family	First written	Last written
`0xa322e5f3d311d3080e6f0121063e9adc2490ef1a`	Etherscan	Wallet, ethereum	resolver wallet	NullReceiver	2026-09-17	2026-09-28
`0xa658864ba658864b68656c6c6f6970626f742121`	Etherscan	Wallet, ethereum		NullReceiver	2026-09-17	2026-09-28

ip address EtherHiding / UNC5342NullReceiverContagious Interview PolinRider CURATED

First seen 2026-08-02 · last seen 2026-11-04

Network

Kind	data centre
Network	Ace Data Centers II (Evoxt)
Announced by	AS149440 Evoxt Sdn. Bhd.
Country	United Kingdom
Flags	hosting range

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

Command-and-control IP decoded from the NullReceiver destination address that the watchlisted resolver wallet pointed to from 2026-09-17 onwards, still current when this entry was written on 2026-09-20. This is an on-chain observation by this site, not a value carried in published reporting. It is recorded as the address the malware resolves to, not as a host this site has observed serving anything; the transaction that carries it is on-chain and public, while what the IP was doing at any given moment is not. It returns to 166.88.134.0/24, the same block as the 166.88.134.62 OpenSourceMalware reported.
Ethereum transaction 0x8394df46a1b832271fd59a5d4ebcfe4eb10845e87e0cd8e5a73d930dbf96b644 — Chollima Hunter (on-chain observation) · published 2026-09-17 · pulled 2026-09-20
Command-and-control IP decoded from the NullReceiver destination address that the watchlisted resolver wallet pointed to from 2026-09-17 onwards, still current when this entry was written on 2026-09-20. This is an on-chain observation by this site, not a value carried in published reporting. It is recorded as the address the malware resolves to, not as a host this site has observed serving anything; the transaction that carries it is on-chain and public, while what the IP was doing at any given moment is not. It returns to 166.88.134.0/24, the same block as the 166.88.134.62 OpenSourceMalware reported.
NullReceiver's Blank Crypto Transfers Solves the Challenges of EtherHiding — OpenSourceMalware · published 2026-08-02 · pulled 2026-09-20
…The result actually decoded in this round was 166.88.134.75.…
PolinRider Poisons Nova, Using On-Chain Transactions as a C2 Manager — SlowMist · under “From a Single Line of Configuration to On-Chain Resolution” · published 2026-09-21 · pulled 2026-10-01
…to 2026-08-27 23.27.13.135 2026-08-28 to 2026-09-03 166.88.73.46 2026-09-04 to 2026-09-17 193.247.144.38 2026-09-17 to 2026-09-28 166.88.134.75 2026-09-28 to 2026-09-30 91.218.183.174 The first server, 166.88.134.62 , is the server that the @joyfill stage 2 selects for…
PolinRider Switches to Ethereum C2 in 30+ Repositories — SafeDep · under “The second Ethereum wallet” · published 2026-09-30 · pulled 2026-10-02
…Ví của kẻ tấn công: 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a IP C&C: 166.88.134.62 , 23.27.13.135 , 166.88.73.46 , 193.247.144.38 , 166.88.134.75 , 91.218.183.174 , 23.27.13.72 Chuỗi tĩnh: A10-npm3! , helloipbot!! 7.6.…
EtherRAT phát tán qua giả mạo hỗ trợ IT trên Microsoft Teams: Smart contract Ethereum làm cơ chế phân giải C&C — BlueCyber · under “7.5. IoC” · published 2026-10-18 · pulled 2026-10-26
…multiple IP addresses which are used as a C2 server. We found the following IP addresses being used by the malware – 103.179.143.219, 166.88.134.75, 23.27.13.72, 95.135.181.151 After downloading the remote payload from the server, the malware executes it using the same node -i command…
PolinRider Returns: Hijacked npm Packages Use Ethereum Blockchain to Conceal Malware Infrastructure | OX Security — OxSecurity · under “Threat Analysis” · published 2026-11-04 · pulled 2026-11-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Ethereum transaction 0x8394df46a1b832271fd59a5d4ebcfe4eb10845e87e0cd8e5a73d930dbf96b644

Chollima Hunter (on-chain observation) lists 1 other indicator in this source.

Cited by the same report: NullReceiver's Blank Crypto Transfers Solves the Challenges of EtherHiding

OpenSourceMalware lists 15 other indicators in this source. 6 are shown, chosen across types.

All 16 indicators from this source

Cited by the same report: PolinRider Poisons Nova, Using On-Chain Transactions as a C2 Manager

SlowMist lists 1 other indicator in this source.