← Remote Workers

181.214.149.147

181.214.149.147 is an IP address that 2 published sources report in connection with NullReceiver and PolinRider activity, which public reporting attributes to North Korea (DPRK). It is cited here from Ransom-ISAC and SafeDep. The earliest of those reports is dated 2026-09-25 and the most recent 2026-09-30.

On-chain links

EtherHiding addresses that pointed malware at this host, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. See the EtherHiding Tracker.

ip address NullReceiverPolinRider MATCHED IN SOURCE

First seen 2026-09-25 · last seen 2026-09-30

Network

Looked up 2026-10-01 at ip-api.com. A hosting range is not evidence on its own.

Sources

• …23.27.20.187:443 1,987 03 Sep 2026 15:39 to 07 Sep 2026 13:52 0xB5D6959301bbB5D69593005000FfABa8a5A2ADA2 181.214.149.147:443 111 07 Sep 2026 14:43 to 21 Sep 2026 21:25 0xB5D6959401bbb5D69594005000ff8C84e0b715b1 181.214.149.148:443 502 The IP address…

  XCTDH Adopts Hash Hiding — Ransom-ISAC · under “On-Chain IOC Timeline” · published 2026-09-25 · pulled 2026-10-01

• …23.27.20.187:443 AS149440 Evoxt 2026-06-24 to 2026-09-03 23.27.20.187:443 23.27.20.187:80 AS149440 Evoxt 2026-09-03 to 2026-09-07 181.214.149.147:443 181.214.149.147:80 AS397423 Tier.Net 2026-09-07 to 2026-09-25 181.214.149.148:443 181.214.149.148:80 AS397423 Tier.Net 2026-09-25…

  PolinRider Switches to Ethereum C2 in 30+ Repositories — SafeDep · under “The first wallet is a public log” · published 2026-09-30 · pulled 2026-10-02

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: XCTDH Adopts Hash Hiding

Ransom-ISAC lists 3 other indicators in this source.

• 181.214.149.148 IP address
• 23.27.20.187 IP address
• 0xb5d6959401bbb5d69594005000ff8c84e0b715b1 cryptocurrency wallet address

Cited by the same report: PolinRider Switches to Ethereum C2 in 30+ Repositories

SafeDep lists 44 other indicators in this source. 9 are shown, chosen across types.

• creativetimofficial/argon-dashboard-flask compromised repository
• creativetimofficial/black-dashboard-django compromised repository
• creativetimofficial/material-dashboard-django compromised repository
• devpardo/mannylapidamaker compromised repository
• 02b7e072c51ac6f7037c2fd4727fcdb06bee6f74cc1af182f7180d8b5e904d63 file hash
• 3be09f8c0a95f993a0ee99e08dca08eb15e1c0abeaf90b190a76e842028e552b file hash
• 5cbcb8e11f6152c80cf88f752bcf9cb1077a88eac5e4eb02471f093248db01ac file hash
• 84a3f1bd81ae4780776c93f9a5ec1cb0d7d6fb613f4a104cceaa93568bdbd0ab file hash
• 45.137.198.133 IP address

All 45 indicators from this source