`166.88.134.62`

166.88.134.62 is an IP address that 10 published sources report in connection with EtherHiding / UNC5342, NullReceiver, Contagious Interview, PolinRider and unclustered DPRK activity, which public reporting attributes to North Korea (DPRK). It is cited here from OpenSourceMalware, SafeDep, Socket, Isotope13, SlowMist and BlueCyber. The earliest of those reports is dated 2026-07-28 and the most recent 2026-11-03.

On-chain links

EtherHiding addresses that pointed malware at this host, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. See the EtherHiding Tracker.

Address	Transaction	Type	Role	Malware family	First written	Last written
`0xa322e5f3d311d3080e6f0121063e9adc2490ef1a`	Etherscan	Wallet, ethereum	resolver wallet	NullReceiver	2026-07-25	2026-08-22
`0xa658863ea658863e68656c6c6f6970626f742121`	Etherscan	Wallet, ethereum		NullReceiver	2026-07-25	2026-08-22

ip address EtherHiding / UNC5342NullReceiverContagious Interview PolinRiderDPRK (cluster unattributed) CURATED

First seen 2026-07-28 · last seen 2026-11-03

Network

Kind	data centre
Network	Ace Data Centers II (Evoxt)
Announced by	AS149440 Evoxt Sdn. Bhd.
Country	United Kingdom
Flags	hosting range

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

As printed:

The transaction we recovered carries zero value and zero data ( "input": "0x" ) — a completely mundane wallet-to-wallet transfer. There’s no contract to flag and no payload field to fingerprint. The recipient bytes decode to 166.88.134.62 , and — as an added attacker fingerprint — the trailing bytes of the same address spell out the ASCII string "helloipbot!!" .

Notes:

Command-and-control IP decoded from the NullReceiver destination address, as reported by OpenSourceMalware. It is recorded as the address the malware resolves to, not as a host this site has observed serving anything; the transaction that carries it is on-chain and public, while what the IP was doing at any given moment is not. This site read the resolver wallet again on 2026-09-03 and found it pointing at a different address; see nullreceiver-c2-ip-166-88-73-46. The value here is what the cited reporting recorded and what the wallet still resolved to at nonce 150 on 2026-08-18, not necessarily what it resolves to now.
NullReceiver's Blank Crypto Transfers Solves the Challenges of EtherHiding — OpenSourceMalware · published 2026-08-02 · pulled 2026-08-30
…The recipient bytes decode to 166.88.134.62 , and — as an added attacker fingerprint — the trailing bytes of the same address spell out the ASCII string "helloipbot!!" . In this code…
NullReceiver's Blank Crypto Transfers Solves the Challenges of EtherHiding | OpenSourceMalware — OpenSourceMalware · under “What NullReceiver does differently” · published 2026-08-02 · pulled 2026-09-11
…infrastructure we and three other research teams have now watched this same actor reuse for five months. Indicator Value Status 166.88.134.62:443 / :80 primary C2 novel to this incident 23.27.13.43 stage 2 loader novel to this incident 198.105.127.210:443 / :80 C2 shared…
PolinRider Caused Dozens of npm, Go, PHP Compromises | OpenSourceMalware — OpenSourceMalware · under “Joyfill compromise” · published 2026-07-31 · pulled 2026-09-11
…_$_9f51 string table) 2 _V = global[ '_V' ] || 0 ; 3 4 if (_V[ 0 ] === 'A' || _V === '0' ) { 5 global[ '_t_s' ] = 'http://166.88.134.62:443' ; 6 global[ '_t_u' ] = 'http://166.88.134.62' ; 7 } else if ( ! isNaN ( parseInt (_V))) { 8 global[ '_t_s' ] =…
Joyfill npm Packages Compromised with Blockchain C2 Loader - Real-time Open Source Software Supply Chain Security — SafeDep · under “Stage 2: C2 server selection and second blockchain fetch” · published 2026-07-29 · pulled 2026-09-11
…same Tron or Aptos to BSC resolution method a second time. For the Joyfill marker A9-0135-3 , the loader sets the Socket.IO endpoint to 166.88.134.62:443 and the upload host to 166.88.134.62 .…
Two Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access Trojan | Socket — Socket · under “The first recovered payload: C2 selection and a second blockchain hop #” · published 2026-07-28 · pulled 2026-09-11
…That wallet has been publishing an address every 15 minutes or so since late July, rotating through 166.88.134.62 , 23.27.13.135 , 166.88.73.46 , and 193.247.144.38 .…
BindsNET repository carried a forged merge commit that ran malware on folder open — Isotope13 · under “BindsNET repository carried a forged merge commit that ran malware on folder open” · published 2026-08-29 · pulled 2026-09-12
…Ethereum Sender Address # 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a Resolved C2 IP Addresses # 193.247.144.38 166.88.73.46 166.88.134.62 23.27.13.135 Payload Files # 7d47c430e6e404dc2fa8b4837678d1cbdb4d0aeacec9b405655cab79d54a2ad9 - tailwind.config.js…
PolinRider Spreads Through Compromised GitHub Accounts and Packagist | Socket — Socket · under “Resolved C2 IP Addresses #” · published 2026-09-17 · pulled 2026-09-29
…The most recent five cycles corresponded to 166.88.134.62, 23.27.13.135, 166.88.73.46, 193.247.144.38, and the current round's 166.88.134.75, respectively. Press enter or click to view image in…
PolinRider Poisons Nova, Using On-Chain Transactions as a C2 Manager — SlowMist · under “From a Single Line of Configuration to On-Chain Resolution” · published 2026-09-21 · pulled 2026-10-01
…uses Ethereum, and the other uses a Tron address pair that SafeDep did not find in public reports. Two C2 servers, 198.105.127.210 and 166.88.134.62 , also appear in the earlier SafeDep astro.config.mjs and @joyfill investigations. The OpenSSF malicious-packages database has 70 npm and…
PolinRider Switches to Ethereum C2 in 30+ Repositories — SafeDep · under “Key findings” · published 2026-09-30 · pulled 2026-10-02
…a658863e a658863e 68656c6c6f6970626f742121 │ │ └─ "helloipbot!!" (chuỗi chữ ký của kẻ tấn công) │ └─ lặp lại 4 byte IP └─ a6.58.86.3e = 166.88.134.62 (IP C&C) Phía nạn nhân chỉ đọc dữ liệu blockchain: không gọi contract, không tạo giao dịch và không trả gas. 7.2.…
EtherRAT phát tán qua giả mạo hỗ trợ IT trên Microsoft Teams: Smart contract Ethereum làm cơ chế phân giải C&C — BlueCyber · under “7.1. Cơ chế hoạt động” · published 2026-10-18 · pulled 2026-10-26
…(Dated) 7 of 13 N/A (Context only) Crucially, only one indicator that VirusTotal missed was flagged anywhere else: URLhaus listed 166.88.134.62 (PolinRider), which VirusTotal had never seen.…
Why Conventional Reputation Feeds Miss Software Supply Chain Attacks | OpenSourceMalware — OpenSourceMalware · under “The cross-platform test: Testing the other intelligence dimensions” · published 2026-11-03 · pulled 2026-11-12
…from _$_9f51 string table) _V = global [ '_V' ] || 0 ; if ( _V [ 0 ] === 'A' || _V === '0' ) { global [ '_t_s' ] = 'http://166.88.134.62:443' ; global [ '_t_u' ] = 'http://166.88.134.62' ; } else if ( ! isNaN ( parseInt ( _V ))) { global [ '_t_s' ] =…
Joyfill npm Packages Compromised with Blockchain C2 Loader - Real-time Open Source Software Supply Chain Security — SafeDep · under “Stage 2: C2 server selection and second blockchain fetch” · published 2026-07-29 · pulled 2026-11-13
Third-party-reported, not independently verified by Chollima Hunter. The report marks two of these as novel to the incident it describes and the rest as already shared with PolinRider infrastructure, which is why most were already held here from other reporting; carrying them again records the corroboration rather than adding new claims. These are the attacker-side entries from the report's indicator table only. The 27 compromised packages and Go modules it also lists are the projects that were attacked, and naming those as indicators would name the victims.
PolinRider Caused Dozens of npm, Go, PHP Compromises — OpenSourceMalware · published 2026-07-30 · pulled 2026-09-09

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: NullReceiver's Blank Crypto Transfers Solves the Challenges of EtherHiding

OpenSourceMalware lists 15 other indicators in this source. 7 are shown, chosen across types.

All 16 indicators from this source

Cited by the same report: PolinRider Caused Dozens of npm, Go, PHP Compromises | OpenSourceMalware

OpenSourceMalware lists 16 other indicators in this source. 5 are shown, chosen across types.

All 17 indicators from this source