← Remote Workers

181.214.149.148

181.214.149.148 is an IP address that 2 published sources report in connection with NullReceiver and PolinRider activity, which public reporting attributes to North Korea (DPRK). It is cited here from Ransom-ISAC and SafeDep. The earliest of those reports is dated 2026-09-25 and the most recent 2026-09-30.

On-chain links

EtherHiding addresses that pointed malware at this host, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. See the EtherHiding Tracker.

ip address NullReceiverPolinRider MATCHED IN SOURCE

First seen 2026-09-25 · last seen 2026-09-30

Network

Looked up 2026-10-01 at ip-api.com. A hosting range is not evidence on its own.

Sources

• …needs: to = 0xB5D6959401bbb5D69594005000ff8C84e0b715b1 ││││││││││││ ││││││││└┴┴┴── Port: 01bb → 443 └┴┴┴┴┴┴┴────── IP: B5.D6.95.94 → 181.214.149.148 The remaining bytes hold a secondary endpoint and padding.…

  XCTDH Adopts Hash Hiding — Ransom-ISAC · under “The HashHiding Technique” · published 2026-09-25 · pulled 2026-10-01

• …AS149440 Evoxt 2026-09-03 to 2026-09-07 181.214.149.147:443 181.214.149.147:80 AS397423 Tier.Net 2026-09-07 to 2026-09-25 181.214.149.148:443 181.214.149.148:80 AS397423 Tier.Net 2026-09-25 to 2026-09-28 198.105.127.210:443 198.105.127.210:80 AS149440 Evoxt 2026-09-28 to…

  PolinRider Switches to Ethereum C2 in 30+ Repositories — SafeDep · under “The first wallet is a public log” · published 2026-09-30 · pulled 2026-10-02

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: XCTDH Adopts Hash Hiding

Ransom-ISAC lists 3 other indicators in this source.

• 181.214.149.147 IP address
• 23.27.20.187 IP address
• 0xb5d6959401bbb5d69594005000ff8c84e0b715b1 cryptocurrency wallet address

Cited by the same report: PolinRider Switches to Ethereum C2 in 30+ Repositories

SafeDep lists 44 other indicators in this source. 9 are shown, chosen across types.

• creativetimofficial/black-dashboard-django compromised repository
• creativetimofficial/material-dashboard-django compromised repository
• devpardo/mannylapidamaker compromised repository
• Dhruvone8/iChat compromised repository
• 3be09f8c0a95f993a0ee99e08dca08eb15e1c0abeaf90b190a76e842028e552b file hash
• 5cbcb8e11f6152c80cf88f752bcf9cb1077a88eac5e4eb02471f093248db01ac file hash
• 84a3f1bd81ae4780776c93f9a5ec1cb0d7d6fb613f4a104cceaa93568bdbd0ab file hash
• 45.137.198.133 IP address
• 91.218.183.174 IP address

All 45 indicators from this source