`itemrange.com`

itemrange.com is a domain that one published source reports in connection with EtherHiding and unclustered DPRK activity, which no published source ties to North Korea (DPRK). It is cited here from Hunt.io. The report is dated 2026-08-04.

DPRK link unconfirmed Hunt.io ties this infrastructure to an affiliate of The Gentlemen ransomware operation, not to North Korea; it repeats Sysdig's assessment that EtherRAT is DPRK malware and says it has not verified it. The EtherHiding tracker covers every reported EtherHiding contract and wallet, not only North Korean ones, so this value may belong to another actor.

On-chain links

EtherHiding addresses that pointed malware at this host, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. See the EtherHiding Tracker.

Address	Transaction	Type	Role	Malware family	First written	Last written
`0x40b57c3622c1cbfd699207f71f2de5a8fe256893`	Etherscan	Wallet, ethereum	owner wallet	EtherRAT	2026-07-01	2026-07-01
`0xb3f2897f2bc797e5b9033faef8c81e92b01cb831`	Etherscan	Contract, ethereum	mapping contract	EtherRAT	2026-07-01	2026-07-01

domain EtherHidingDPRK (cluster unattributed) CURATED

First seen 2026-08-04 · last seen 2026-08-04

Registration

Registered	2026-07-01
Registrar	PDR Ltd. d/b/a PublicDomainRegistry.com
Expires	2027-07-01
Last changed	2026-09-05
Status	client transfer prohibited

From the registry’s RDAP record for itemrange.com, looked up 2026-10-11.

Source

As printed:

Historical C2 returned by the EtherRAT Ethereum contract.

Notes:

EtherRAT command-and-control domain the resolver contract 0xb3f2897f2bc797e5b9033faef8c81e92b01cb831 returned from 2026-07-01, from Hunt.io's table of the contract's historical C2.
The Gentlemen Affiliate Deploys EtherRAT Across Windows Networks Using Ethereum Smart Contract C2 — Hunt.io · published 2026-08-04 · pulled 2026-10-11

Find this indicator in the index, or see every domain this site holds under Domains in the browse listing.

Related indicators

Cited by the same report: The Gentlemen Affiliate Deploys EtherRAT Across Windows Networks Using Ethereum Smart Contract C2

Hunt.io lists 6 other indicators in this source.