bloodthornkeep.top
bloodthornkeep.top is a domain
that one published source reports
in connection with EtherHiding activity, which no
published source ties to North Korea (DPRK).
It is cited here from Confiant.
The report is dated 2026-08-28.
DPRK link unconfirmed Confiant tracks this cluster as HexMage, a Magecart card-skimming operation that loads its skimmer through EtherHiding, and names no actor or state; it mentions DPRK-linked EtherHiding only as separate work, and no DPRK link is published for it. The EtherHiding tracker covers every reported EtherHiding contract and wallet, not only North Korean ones, so this value may belong to another actor.
On-chain links
| Address | Transaction | Type | Role | Malware family | First written | Last written |
|---|---|---|---|---|---|---|
0x88361c914bb0942da9a1b7bb396a7513c1917aee |
Wallet, sepolia | owner wallet | Magecart skimmer (HexMage) | |||
0xd641493ea15a3f3b3de327401c8cd63e36236bfb |
Contract, sepolia | Magecart skimmer (HexMage) |
domain EtherHiding CURATED
Registration
| Registered | 2026-06-22 |
|---|---|
| Registrar | NICENIC INTERNATIONAL GROUP CO., LIMITED |
| Expires | 2027-06-22 |
| Last changed | 2026-06-22 |
| Status | client delete prohibited, client transfer prohibited |
Source
-
bloodthornkeep[.]top
HexMage skimmer delivery host that the Ethereum Sepolia contract 0xd641493ea15a3f3b3de327401c8cd63e36236bfb resolves to, observed by Confiant serving the card skimmer to compromised checkout pages.
Skimming on the Blockchain: A Magecart Campaign That Uses EtherHiding, Found by Malvertising Scanning — Confiant
Find this indicator in the index, or see every domain this site holds under Domains in the browse listing.