streetfleshroyalgaming.top
streetfleshroyalgaming.top is a domain
that 2 published sources report
in connection with EtherHiding activity, which no
published source ties to North Korea (DPRK).
It is cited here from Confiant and Chollima Hunter (on-chain observation).
The earliest of those reports is dated 2026-08-28 and the most recent 2026-11-11.
DPRK link unconfirmed Confiant tracks this cluster as HexMage, a Magecart card-skimming operation that loads its skimmer through EtherHiding, and names no actor or state; it mentions DPRK-linked EtherHiding only as separate work, and no DPRK link is published for it. The EtherHiding tracker covers every reported EtherHiding contract and wallet, not only North Korean ones, so this value may belong to another actor.
domain EtherHiding CURATED
Registration
| Registered | 2026-04-29 |
|---|---|
| Registrar | NICENIC INTERNATIONAL GROUP CO., LIMITED |
| Expires | 2027-04-29 |
| Last changed | 2026-04-29 |
| Status | client delete prohibited, client transfer prohibited |
Sources
-
streetfleshroyalgaming[.]top
Host stored in plain base64 in a HexMage resolver contract (0x72814ae4f5ddf7e47fac26a6a834a02d9ac49dde, created 2026-04-29) that Confiant lists as staged rather than observed: written on chain ahead of use, with no skimmer traffic seen for it when the report was written.
Skimming on the Blockchain: A Magecart Campaign That Uses EtherHiding, Found by Malvertising Scanning — Confiant -
Host stored in plain base64 in a HexMage resolver contract (0x72814ae4f5ddf7e47fac26a6a834a02d9ac49dde, created 2026-04-29) that Confiant lists as staged rather than observed: written on chain ahead of use, with no skimmer traffic seen for it when the report was written.
Ethereum Sepolia address 0x72814ae4f5ddf7e47fac26a6a834a02d9ac49dde — Chollima Hunter (on-chain observation)
Find this indicator in the index, or see every domain this site holds under Domains in the browse listing.