`ironphantomcore.top`

ironphantomcore.top is a domain that one published source reports in connection with EtherHiding activity, which no published source ties to North Korea (DPRK). It is cited here from LevelBlue. The report is dated 2026-10-07.

DPRK link unconfirmed LevelBlue SpiderLabs ties this to the PhantomPolia loader, which delivers Remus Stealer through ClickFix lures, and names no actor or state; no DPRK link is published for it. The EtherHiding tracker covers every reported EtherHiding contract and wallet, not only North Korean ones, so this value may belong to another actor.

On-chain links

EtherHiding addresses that pointed malware at this host, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. See the EtherHiding Tracker.

Address	Transaction	Type	Role	Malware family	First written	Last written
`0x3b14187b76dc39005e8d568b26455d53bd198749`		Contract, sepolia		PhantomPolia	reported
`0x92f3f39c1cde5ee705820af022e2b85c4eaa43f6`		Wallet, sepolia	owner wallet	PhantomPolia	reported

domain EtherHiding CURATED

First seen 2026-10-07 · last seen 2026-10-07

Registration

Registered	2026-06-05
Registrar	NICENIC INTERNATIONAL GROUP CO., LIMITED
Expires	2027-06-05
Last changed	2026-06-05
Status	client delete prohibited, client transfer prohibited

From the registry’s RDAP record for ironphantomcore.top, looked up 2026-10-12.

Source

As printed:

ironphantomcore[.]top

Notes:

PhantomPolia C2 domain that the Ethereum Sepolia contract 0x3b14187b76dc39005e8d568b26455d53bd198749 resolves to after decryption, as reported by LevelBlue SpiderLabs.
Inside PhantomPolia: Remus Stealer Delivery via Donut Shellcode in ClickFix Campaign — LevelBlue · published 2026-10-07 · pulled 2026-10-12

Find this indicator in the index, or see every domain this site holds under Domains in the browse listing.

Related indicators

Cited by the same report: Inside PhantomPolia: Remus Stealer Delivery via Donut Shellcode in ClickFix Campaign

LevelBlue lists 40 other indicators in this source. 12 are shown, chosen across types.

All 41 indicators from this source