`oceanvw.click`

oceanvw.click is a domain that one published source reports in connection with EtherHiding activity, which no published source ties to North Korea (DPRK). It is cited here from LevelBlue. The report is dated 2026-10-07.

DPRK link unconfirmed LevelBlue SpiderLabs ties this to the PhantomPolia loader, which delivers Remus Stealer through ClickFix lures, and names no actor or state; no DPRK link is published for it. The EtherHiding tracker covers every reported EtherHiding contract and wallet, not only North Korean ones, so this value may belong to another actor.

domain EtherHiding CURATED

First seen 2026-10-07 · last seen 2026-10-07

Registration

Registered	2026-08-19
Registrar	Dynadot, LLC
Expires	2027-08-19
Last changed	2026-08-24
Status	client transfer prohibited

From the registry’s RDAP record for oceanvw.click, looked up 2026-10-12.

Source

As printed:

oceanvw[.]click

Notes:

Remus Stealer command-and-control domain in the PhantomPolia campaign, the stealer delivered by the loader that resolves its own C2 from Ethereum Sepolia contracts, as reported by LevelBlue SpiderLabs.
Inside PhantomPolia: Remus Stealer Delivery via Donut Shellcode in ClickFix Campaign — LevelBlue · published 2026-10-07 · pulled 2026-10-12

Find this indicator in the index, or see every domain this site holds under Domains in the browse listing.

Related indicators

Cited by the same report: Inside PhantomPolia: Remus Stealer Delivery via Donut Shellcode in ClickFix Campaign

LevelBlue lists 40 other indicators in this source. 12 are shown, chosen across types.

All 41 indicators from this source