`witch-skins-lip-coal.trycloudflare.com`

witch-skins-lip-coal.trycloudflare.com is a domain that one published source reports in connection with EtherHiding / UNC5342 and unclustered DPRK activity, which public reporting attributes to North Korea (DPRK). It is cited here from The DFIR Report. The report is dated 2026-05-11.

On-chain links

EtherHiding addresses that pointed malware at this host, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. See the EtherHiding Tracker.

Address	Transaction	Type	Role	Malware family	First written	Last written
`0x5953f27f044779a3afcd2bf56a4b712583dd2e4e`	Etherscan	Wallet, ethereum	owner wallet	EtherRAT	2026-04-24	2026-04-24
`0xdf0b529043ef7a2bb9111bad26de624a326bacf9`	Etherscan	Contract, ethereum	mapping contract	EtherRAT	2026-04-24	2026-04-24

domain EtherHiding / UNC5342DPRK (cluster unattributed) CURATED

First seen 2026-05-11 · last seen 2026-05-11

Source

As printed:

https://witch-skins-lip-coal.trycloudflare.com

Notes:

TryCloudflare tunnel the operator wrote to EtherRAT resolver contract 0xdf0b529043ef7a2bb9111bad26de624a326bacf9 in April or May 2026, listed by The DFIR Report. TryCloudflare names are ephemeral and free to create, so the name records what the implant was pointed at, not a host likely to be reused. The DFIR Report published this deployment as EtherRAT in an intrusion that ended in The Gentlemen ransomware and names no nation-state; the DPRK label rests only on Sysdig's attribution of the EtherRAT family, so this entry carries low confidence and should not be read as a DPRK attribution of the intrusion itself.
Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware — The DFIR Report · published 2026-05-11 · pulled 2026-10-03

Find this indicator in the index, or see every domain this site holds under Domains in the browse listing.

Related indicators

Cited by the same report: Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware

The DFIR Report lists 12 other indicators in this source.