`166.88.73.46`

166.88.73.46 is an IP address that 7 published sources report in connection with EtherHiding / UNC5342, NullReceiver, Contagious Interview, unclustered DPRK and PolinRider activity, which public reporting attributes to North Korea (DPRK). It is cited here from Chollima Hunter (on-chain observation), OpenSourceMalware, Isotope13, Socket, SlowMist, SafeDep and BlueCyber. The earliest of those reports is dated 2026-08-02 and the most recent 2026-10-18.

On-chain links

EtherHiding addresses that pointed malware at this host, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. See the EtherHiding Tracker.

Address	Transaction	Type	Role	Malware family	First written	Last written
`0xa322e5f3d311d3080e6f0121063e9adc2490ef1a`	Etherscan	Wallet, ethereum	resolver wallet	NullReceiver	2026-08-28	2026-09-03
`0xa658492ea658492e68656c6c6f6970626f742121`	Etherscan	Wallet, ethereum		NullReceiver	2026-08-28	2026-09-03

ip address EtherHiding / UNC5342NullReceiverContagious InterviewDPRK (cluster unattributed)PolinRider CURATED

First seen 2026-08-02 · last seen 2026-10-18

Network

Kind	proxy or VPN
Network	Ace Data Centers II (Evoxt (UK))
Announced by	AS149440 Evoxt Sdn. Bhd.
Country	United Kingdom
Flags	hosting range, known proxy or VPN

Looked up 2026-09-21 at ip-api.com. This range is classed as a proxy or VPN; it does not show who used it.

Sources

Command-and-control IP decoded from the NullReceiver destination address that the watchlisted resolver wallet pointed to on 2026-09-03. This is an on-chain observation by this site, not a value carried in published reporting: OpenSourceMalware reported 166.88.134.62, and the resolver had moved on by the time this site read it. It is recorded as the address the malware resolves to, not as a host this site has observed serving anything; the transaction that carries it is on-chain and public, while what the IP was doing at any given moment is not. It sits in the same 166.88.0.0/16 range as the reported address.
Ethereum transaction 0x7f9dbf90249bab5c55023850a674f61d2c6844474ce889910fa6c0406884ee37 — Chollima Hunter (on-chain observation) · pulled 2026-09-03
Command-and-control IP decoded from the NullReceiver destination address that the watchlisted resolver wallet pointed to on 2026-09-03. This is an on-chain observation by this site, not a value carried in published reporting: OpenSourceMalware reported 166.88.134.62, and the resolver had moved on by the time this site read it. It is recorded as the address the malware resolves to, not as a host this site has observed serving anything; the transaction that carries it is on-chain and public, while what the IP was doing at any given moment is not. It sits in the same 166.88.0.0/16 range as the reported address.
NullReceiver's Blank Crypto Transfers Solves the Challenges of EtherHiding — OpenSourceMalware · published 2026-08-02 · pulled 2026-09-03
…That wallet has been publishing an address every 15 minutes or so since late July, rotating through 166.88.134.62 , 23.27.13.135 , 166.88.73.46 , and 193.247.144.38 .…
BindsNET repository carried a forged merge commit that ran malware on folder open — Isotope13 · under “BindsNET repository carried a forged merge commit that ran malware on folder open” · published 2026-08-29 · pulled 2026-09-12
…Resolver Ethereum Sender Address # 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a Resolved C2 IP Addresses # 193.247.144.38 166.88.73.46 166.88.134.62 23.27.13.135 Payload Files # 7d47c430e6e404dc2fa8b4837678d1cbdb4d0aeacec9b405655cab79d54a2ad9 -…
PolinRider Spreads Through Compromised GitHub Accounts and Packagist | Socket — Socket · under “Resolved C2 IP Addresses #” · published 2026-09-17 · pulled 2026-09-29
…The most recent five cycles corresponded to 166.88.134.62, 23.27.13.135, 166.88.73.46, 193.247.144.38, and the current round's 166.88.134.75, respectively. Press enter or click to view image in full size After the…
PolinRider Poisons Nova, Using On-Chain Transactions as a C2 Manager — SlowMist · under “From a Single Line of Configuration to On-Chain Resolution” · published 2026-09-21 · pulled 2026-10-01
…Evoxt: Active (UTC) C2 2026-07-25 to 2026-08-22 166.88.134.62 2026-08-22 to 2026-08-27 23.27.13.135 2026-08-28 to 2026-09-03 166.88.73.46 2026-09-04 to 2026-09-17 193.247.144.38 2026-09-17 to 2026-09-28 166.88.134.75 2026-09-28 to 2026-09-30 91.218.183.174 The…
PolinRider Switches to Ethereum C2 in 30+ Repositories — SafeDep · under “The second Ethereum wallet” · published 2026-09-30 · pulled 2026-10-02
…npm: npmuser1101 , npmuser3002 Ví của kẻ tấn công: 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a IP C&C: 166.88.134.62 , 23.27.13.135 , 166.88.73.46 , 193.247.144.38 , 166.88.134.75 , 91.218.183.174 , 23.27.13.72 Chuỗi tĩnh: A10-npm3! , helloipbot!! 7.6.…
EtherRAT phát tán qua giả mạo hỗ trợ IT trên Microsoft Teams: Smart contract Ethereum làm cơ chế phân giải C&C — BlueCyber · under “7.5. IoC” · published 2026-10-18 · pulled 2026-10-26

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Ethereum transaction 0x7f9dbf90249bab5c55023850a674f61d2c6844474ce889910fa6c0406884ee37

Chollima Hunter (on-chain observation) lists 2 other indicators in this source.

Cited by the same report: NullReceiver's Blank Crypto Transfers Solves the Challenges of EtherHiding

OpenSourceMalware lists 15 other indicators in this source. 5 are shown, chosen across types.

All 16 indicators from this source