Radar requires both concealed remote-loading behaviour and relevant blockchain infrastructure before surfacing an EtherHiding-like signal.
What EtherHiding means
EtherHiding is a delivery technique in which malicious instructions or payload locations are retrieved through public blockchain infrastructure. The resilient public service becomes part of the delivery chain, which can make simple domain takedowns less effective.
Why blockchain traffic alone is not enough
Wallets, exchanges, games and legitimate decentralised applications commonly contact blockchain nodes. A node hostname by itself is context, not proof of malicious intent.
URL Radar’s evidence threshold
Radar surfaces an EtherHiding-like delivery signal only when a page both contacts recognised public blockchain RPC infrastructure and contains concealed remote-loading behaviour. It does not claim to have read a smart contract or executed returned content unless that specific evidence exists.
Defender response
Review the target’s expected business purpose, the exact node destinations and endpoint or proxy telemetry. A non-crypto page making concealed RPC calls deserves investigation, but blocking decisions should use the complete evidence set.
Reference: Google Threat Intelligence on EtherHiding.