← EtherHiding Tracker

91.221.190.12

91.221.190.12 is an IP address that one published source reports in connection with EtherHiding / UNC5342 and unclustered DPRK activity, which public reporting attributes to North Korea (DPRK). It is cited here from Atos Threat Research Center. The report is dated 2026-04-14.

On-chain links

EtherHiding addresses that pointed malware at this host, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. See the EtherHiding Tracker.

ip address EtherHiding / UNC5342DPRK (cluster unattributed) CURATED

First seen 2026-04-14 · last seen 2026-04-14

Network

Looked up 2026-10-04 at ip-api.com. A subscriber line, as a person working from home ordinarily has.

Source

• As printed:

  http://91.221.190.12

  Notes:

  Address that appeared as a value written to EtherRAT resolver contracts, per Atos's list of domains and addresses found in contract events (first seen 2025-12-11, last seen 2025-12-11, 1 occurrence). A value an operator writes to the contract is the address the implant is sent to, but this site has not observed the host serving anything. Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.

  EtherRAT-appendixes (IoCs/wallets_and_contracts.csv) — Atos Threat Research Center · published 2026-04-14 · pulled 2026-10-03

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: EtherRAT-appendixes (IoCs/wallets_and_contracts.csv)

Atos Threat Research Center lists 96 other indicators in this source. 12 are shown, chosen across types.

• 135.125.255.55 IP address
• 173.249.8.102 IP address
• adexplore/Kusto.Explorer malicious repository
• azpath/AzCopy malicious repository
• bartuser/BarTender malicious repository
• beycmp/Beyond-Compare malicious repository
• 0x21f9a727e9668a3fc30393a344d8a3a98f4f3b8d smart contract address
• 0x22f96d61cf118efabc7c5bf3384734fad2f6ead4 smart contract address
• 0x277852e1c349b03c79e348018a8391bd21c412e8 smart contract address
• 0x2eb2ec6026b63158042d27e8004957ec71783287 cryptocurrency wallet address
• 0x3372a63ee825d09b4daee979513980f99c731db5 cryptocurrency wallet address
• 0x37ef6e88425613564b2cf8adc496acff4b6481a9 cryptocurrency wallet address

All 97 indicators from this source