`23.27.13.72`

23.27.13.72 is an IP address that 4 published sources report in connection with EtherHiding / UNC5342, NullReceiver, Contagious Interview and PolinRider activity, which public reporting attributes to North Korea (DPRK). It is cited here from Chollima Hunter (on-chain observation), OpenSourceMalware, BlueCyber and OxSecurity. The earliest of those reports is dated 2026-08-02 and the most recent 2026-11-04.

On-chain links

EtherHiding addresses that pointed malware at this host, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. See the EtherHiding Tracker.

Address	Transaction	Type	Role	Malware family	First written	Last written
`0xa322e5f3d311d3080e6f0121063e9adc2490ef1a`	Etherscan	Wallet, ethereum	resolver wallet	NullReceiver	2026-10-14	2026-10-14

ip address EtherHiding / UNC5342NullReceiverContagious Interview PolinRider CURATED

First seen 2026-08-02 · last seen 2026-11-04

Network

Kind	data centre
Network	Ace Data Centers II (Evoxt)
Announced by	AS149440 Evoxt Sdn. Bhd.
Country	United Kingdom
Flags	hosting range

Looked up 2026-10-20 at ip-api.com. A hosting range is not evidence on its own.

Sources

Command-and-control IP decoded from the NullReceiver destination address 0x171b0d48171b0d4868656c6c6f6970626f742121 that the watchlisted resolver wallet pointed to on 2026-10-14, replacing 193.247.144.38. This is an on-chain observation by this site, not a value carried in published reporting. It is recorded as the address the malware resolved to, not as a host this site has observed serving anything. It sits in 23.27.13.0/24 with 23.27.13.135, the resolver's destination of August 2026.
Ethereum transaction 0x41dbce9299554bcf71f6f86f4e1bca60f9a4e057837082ea9c820091f6ebe2fe — Chollima Hunter (on-chain observation) · published 2026-10-14 · pulled 2026-10-18
Command-and-control IP decoded from the NullReceiver destination address 0x171b0d48171b0d4868656c6c6f6970626f742121 that the watchlisted resolver wallet pointed to on 2026-10-14, replacing 193.247.144.38. This is an on-chain observation by this site, not a value carried in published reporting. It is recorded as the address the malware resolved to, not as a host this site has observed serving anything. It sits in 23.27.13.0/24 with 23.27.13.135, the resolver's destination of August 2026.
NullReceiver's Blank Crypto Transfers Solves the Challenges of EtherHiding — OpenSourceMalware · published 2026-08-02 · pulled 2026-10-18
…IP C&C: 166.88.134.62 , 23.27.13.135 , 166.88.73.46 , 193.247.144.38 , 166.88.134.75 , 91.218.183.174 , 23.27.13.72 Chuỗi tĩnh: A10-npm3! , helloipbot!! 7.6.…
EtherRAT phát tán qua giả mạo hỗ trợ IT trên Microsoft Teams: Smart contract Ethereum làm cơ chế phân giải C&C — BlueCyber · under “7.5. IoC” · published 2026-10-18 · pulled 2026-10-26
…which are used as a C2 server. We found the following IP addresses being used by the malware – 103.179.143.219, 166.88.134.75, 23.27.13.72, 95.135.181.151 After downloading the remote payload from the server, the malware executes it using the same node -i command described…
PolinRider Returns: Hijacked npm Packages Use Ethereum Blockchain to Conceal Malware Infrastructure | OX Security — OxSecurity · under “Threat Analysis” · published 2026-11-04 · pulled 2026-11-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: NullReceiver's Blank Crypto Transfers Solves the Challenges of EtherHiding

OpenSourceMalware lists 15 other indicators in this source. 7 are shown, chosen across types.

All 16 indicators from this source

Cited by the same report: EtherRAT phát tán qua giả mạo hỗ trợ IT trên Microsoft Teams: Smart contract Ethereum làm cơ chế phân giải C&C

BlueCyber lists 2 other indicators in this source.