`93.152.220.219`

93.152.220.219 is an IP address that one published source reports in connection with EtherHiding activity, which no published source ties to North Korea (DPRK). It is cited here from The DFIR Report. The report is dated 2026-10-12.

DPRK link unconfirmed The DFIR Report names SectopRAT (ArechClient2), commodity malware, and attributes this activity to no actor or state; no DPRK link is published for it. The EtherHiding tracker covers every reported EtherHiding contract and wallet, not only North Korean ones, so this value may belong to another actor.

On-chain links

EtherHiding addresses that pointed malware at this host, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. See the EtherHiding Tracker.

Address	Transaction	Type	Role	Malware family	First written	Last written
`0xb11613acf39ad3b4dde427c27068d278fafa8998`		Contract, bsc		SectopRAT	reported
`0xe6975e14513283a5161ca883437a4e4b7298f1ca`		Wallet, bsc	owner wallet	SectopRAT	reported

ip address EtherHiding CURATED

First seen 2026-10-12 · last seen 2026-10-12

Network

Kind	proxy or VPN
Network	Dedik Services Limited
Announced by	AS207043 DEDIK SERVICES LIMITED
Country	The Netherlands
Flags	hosting range, known proxy or VPN

Looked up 2026-10-12 at ip-api.com. This range is classed as a proxy or VPN; it does not show who used it.

Source

As printed:

93[.]152[.]220[.]219:443

Notes:

SectopRAT command-and-control address, on port 443, that The DFIR Report lists for the intrusion whose configuration was read from BNB Smart Chain contract 0xb11613acf39ad3b4dde427c27068d278fafa8998.
SectopRAT loaded through signed SonicWall, IBM, Blue Iris and ON1 executables, with C2 configuration read from a BNB Smart Chain contract — The DFIR Report · pulled 2026-10-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: SectopRAT loaded through signed SonicWall, IBM, Blue Iris and ON1 executables, with C2 configuration read from a BNB Smart Chain contract

The DFIR Report lists 8 other indicators in this source.