← EtherHiding Tracker

89.19.222.25

89.19.222.25 is an IP address that 2 published sources report in connection with EtherHiding / UNC5342 and Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from Chollima Hunter (on-chain observation) and Ransom-ISAC. The earliest of those reports is dated 2026-09-25 and the most recent 2026-10-05.

On-chain links

EtherHiding addresses that pointed malware at this host, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. See the EtherHiding Tracker.

ip address EtherHiding / UNC5342Contagious Interview CURATED

First seen 2026-09-25 · last seen 2026-10-05

Network

Looked up 2026-10-11 at ip-api.com. A subscriber line, as a person working from home ordinarily has.

Sources

• Command-and-control IP decoded from the recipient address 0x5913de1901bb5913de19005000ffa1f0bdf09aea, which the watchlisted XCTDH signal wallet 0x33ff3edaf55a8e03dcbc7cb40d498a49cd499891 began paying on 2026-10-05 and was still paying on 2026-10-07. Read with the encoding Ransom-ISAC published for this wallet: the first four bytes are the IP and the next two the port, 01bb or 443, with the same IP repeated as the secondary endpoint on port 80. This is an on-chain observation by this site, made after the report was published, and it is recorded as the address the implant is pointed at, not as a host this site has observed serving anything.

  Ethereum transaction 0x172bf4fc46df4558fc66259d33b469d50f4c7b431f1d421e0f44dbf8ca1067ff — Chollima Hunter (on-chain observation) · published 2026-10-05 · pulled 2026-10-11

• Command-and-control IP decoded from the recipient address 0x5913de1901bb5913de19005000ffa1f0bdf09aea, which the watchlisted XCTDH signal wallet 0x33ff3edaf55a8e03dcbc7cb40d498a49cd499891 began paying on 2026-10-05 and was still paying on 2026-10-07. Read with the encoding Ransom-ISAC published for this wallet: the first four bytes are the IP and the next two the port, 01bb or 443, with the same IP repeated as the secondary endpoint on port 80. This is an on-chain observation by this site, made after the report was published, and it is recorded as the address the implant is pointed at, not as a host this site has observed serving anything.

  XCTDH Adopts Hash Hiding — Ransom-ISAC · published 2026-09-25 · pulled 2026-10-11

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: XCTDH Adopts Hash Hiding

Ransom-ISAC lists 19 other indicators in this source. 12 are shown, chosen across types.

• 103.213.248.45 IP address
• 111.90.143.39 IP address
• 136.0.7.231 IP address
• 95.135.181.15 IP address
• 95.135.181.25 IP address
• 0x610c9ec972545b8df6e3aaecc7a8ab5f2f2445cf0bfbd6ee026e618d07b29e22 transaction hash
• 0x84e8cecd5b077eef530e7d69d546e2555199cb61759d1224d31cb31750788f62 transaction hash
• 0x171b14bb0050171b14bb01bb398eaab6441fbd47 cryptocurrency wallet address
• 0x171b14bb01bb171b14bb0050eb7f39c35c47e682 cryptocurrency wallet address
• 0xb5d6959301bbb5d69593005000ffaba8a5a2ada2 cryptocurrency wallet address
• TCqf6ZkaQD84vYsC2cuu1jRwB6JveTaRrF cryptocurrency wallet address
• TFMryB9m6d4kBMRjEVyFRbqKSV1cV2NcpH cryptocurrency wallet address

All 20 indicators from this source