`ccppeptides.art`

ccppeptides.art is a domain that one published source reports in connection with EtherHiding / UNC5342 and unclustered DPRK activity, which public reporting attributes to North Korea (DPRK). It is cited here from Chollima Hunter (on-chain observation). The report is dated 2026-05-28.

On-chain links

EtherHiding addresses that pointed malware at this host, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. See the EtherHiding Tracker.

Address	Transaction	Type	Role	Malware family	First written	Last written
`0x2dbca26addf031ada655861933d0386a39ea6427`	Etherscan	Wallet, ethereum	owner wallet	EtherRAT	2026-05-28	2026-05-28
`0x8b12e09abb2e5130310b24c75b51c8afd85e8223`	Etherscan	Contract, ethereum	mapping contract	EtherRAT	2026-05-28	2026-05-28

domain EtherHiding / UNC5342DPRK (cluster unattributed) CURATED

First seen 2026-05-28 · last seen 2026-05-28

Registration

Registered	2026-05-01
Registrar	NameCheap, Inc.
Expires	2027-05-01
Last changed	2026-06-01
Status	client transfer prohibited

From the registry’s RDAP record for ccppeptides.art, looked up 2026-10-05.

Source

EtherRAT command-and-control domain the operator wallet 0x2dbca26addf031ada655861933d0386a39ea6427 wrote to the watchlisted resolver contract 0x8b12e09abb2e5130310b24c75b51c8afd85e8223 with setString on 2026-05-28 (transaction 0x8e55fdd55f91bd451624267e083643f5ff35c14c9ef3f8c43bb367f5dcb27fd0), between publisherresolution.com and dns1.southafricanorth.cloudapp.azure.com, read by this site from the contract's write history. The domain was registered on 2026-05-01, four weeks before the write. It was first held as a parked value because its registrar differed from that of some other EtherRAT domains; the operator's C2 domains use several registrars, and a recent registration written by the operator's own wallet between two C2 values is not the pattern of the dictionary-word parked values, so it was reclassified on 2026-10-05. Recorded as the address the implant was pointed at, not as a host this site has observed serving anything.
EtherRAT resolver contract 0x8b12e09abb2e5130310b24c75b51c8afd85e8223 — Chollima Hunter (on-chain observation) · published 2026-05-28 · pulled 2026-10-05

Find this indicator in the index, or see every domain this site holds under Domains in the browse listing.

Related indicators

Cited by the same report: EtherRAT resolver contract 0x8b12e09abb2e5130310b24c75b51c8afd85e8223

Chollima Hunter (on-chain observation) lists 6 other indicators in this source.