On May 2nd, the founder of the slow fog, Cosin Weibo, said that some C2 (also called C&C, the control end of the worm) technology of mining worms recently borrowed the Ethereum transaction record as the dynamic acquisition of the C2 address. Probably the technical mode is: 1. Dynamically obtain the tx record of the specified Ethereum address through EtherscanAPI; 2. Parse the latest tx record, get the input content; 3. Parse the input content to get the final C2 address.