permission-resident-lots-ebooks.trycloudflare.com
permission-resident-lots-ebooks.trycloudflare.com is a hosted site
that one published source reports
in connection with EtherHiding / UNC5342 and unclustered DPRK activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Chollima Hunter (on-chain observation).
The report is dated 2026-03-26.
On-chain links
| Address | Transaction | Type | Role | Malware family | First written | Last written |
|---|---|---|---|---|---|---|
0x9268cc33d59415b033dc5d709ce30bbe09708fe3 |
Etherscan | Contract, ethereum | mapping contract | EtherRAT | 2026-03-26 | 2026-03-27 |
0x95c1f98be0cbb581e31c57c3f17d2853b4a445a7 |
Etherscan | Wallet, ethereum | owner wallet | EtherRAT | 2026-03-26 | 2026-03-27 |
hosted site EtherHiding / UNC5342DPRK (cluster unattributed) CURATED
Source
-
EtherRAT command-and-control Cloudflare quick tunnel the operator wrote to the watchlisted resolver contract 0x9268cc33d59415b033dc5d709ce30bbe09708fe3 with setString between 2026-03-26 and 2026-03-27, read by this site from the contract's write history. Recorded as the address the implant was pointed at, not as a host this site has observed serving anything. A quick tunnel is short-lived and its name is assigned at random, so the value matters for matching traffic from that window rather than as standing infrastructure.
EtherRAT resolver contract 0x9268cc33d59415b033dc5d709ce30bbe09708fe3 — Chollima Hunter (on-chain observation)
Find this indicator in the index, or see every hosted site this site holds under Hosted sites in the browse listing.