`103.179.142.155`

103.179.142.155 is an IP address that 3 published sources report in connection with EtherHiding / UNC5342, NullReceiver and Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from Chollima Hunter (on-chain observation), OpenSourceMalware and Jfrog. The earliest of those reports is dated 2026-08-02 and the most recent 2026-11-09.

On-chain links

EtherHiding addresses that pointed malware at this host, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. See the EtherHiding Tracker.

Address	Transaction	Type	Role	Malware family	First written	Last written
`0xa322e5f3d311d3080e6f0121063e9adc2490ef1a`	Etherscan	Wallet, ethereum	resolver wallet	NullReceiver	2026-10-16	2026-10-19

ip address EtherHiding / UNC5342NullReceiverContagious Interview CURATED

First seen 2026-08-02 · last seen 2026-11-09

Network

Kind	fixed line
Network	Evoxt Enterprise
Announced by	AS149440 Evoxt Sdn. Bhd.
Country	United States

Looked up 2026-10-20 at ip-api.com. A subscriber line, as a person working from home ordinarily has.

Sources

Command-and-control IP decoded from the NullReceiver destination address 0x67b38e9b67b38e9b68656c6c6f6970626f742121 that the watchlisted resolver wallet has pointed to since 2026-10-16, still current when this entry was written on 2026-10-18. This is an on-chain observation by this site, not a value carried in published reporting. It is recorded as the address the malware resolves to, not as a host this site has observed serving anything.
Ethereum transaction 0xe99a7a400c66d594b8e126c9c831bd10651dbf5ccaae1e75bec4a8a1a2390905 — Chollima Hunter (on-chain observation) · published 2026-10-16 · pulled 2026-10-18
Command-and-control IP decoded from the NullReceiver destination address 0x67b38e9b67b38e9b68656c6c6f6970626f742121 that the watchlisted resolver wallet has pointed to since 2026-10-16, still current when this entry was written on 2026-10-18. This is an on-chain observation by this site, not a value carried in published reporting. It is recorded as the address the malware resolves to, not as a host this site has observed serving anything.
NullReceiver's Blank Crypto Transfers Solves the Challenges of EtherHiding — OpenSourceMalware · published 2026-08-02 · pulled 2026-10-18
…2026-10-19T10:22:59Z nonce 608 to 0x67B38e9b67B38E9b68656c6C6f6970626f742121 67.B3.8E.9B = 103.179.142.155, twice, then "helloipbot!!" The careers site is not standing in front of the malware.…
Contagious Interview - One Interview Away From Infection - JFrog Security Research — Jfrog · under “The site hands out the loader itself” · published 2026-11-09 · pulled 2026-11-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: NullReceiver's Blank Crypto Transfers Solves the Challenges of EtherHiding

OpenSourceMalware lists 15 other indicators in this source. 7 are shown, chosen across types.

All 16 indicators from this source

Cited by the same report: Contagious Interview - One Interview Away From Infection - JFrog Security Research

Jfrog lists 4 other indicators in this source.