🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for domain sqwas.shapelie.com.

Database Entry


IOC ID:1964564
IOC: sqwas.shapelie.com
IOC Type :domain
Threat Type :botnet_cc
Malware: GHOSTBLADE
Confidence Level : Confidence level is high (100%)
Is compromised? : False
ASN:AS214379 SPN
Country:- UA
First seen:2026-10-14 05:42:57 UTC
Last seen:never
UUID:43f304e7-c757-11f1-bd13-42010aa4000a
Reporter Daydream
Reward 5 credits from ThreatFox
Tags:DarkSword GHOSTBLADE ios
Reference: https://bazaar.abuse.ch/sample/2e5a56beb63f21d9347310412ae6efb29fd3db2d3a3fc0798865a29a3c578d35/

Avatar
Daydream
GHOSTBLADE (DarkSword JavaScript implant) upload hosts, hardcoded in clear. sqwas.shapelie.com: SERVER_HOST in ghostblade.js (2e5a56beb63f21d9347310412ae6efb29fd3db2d3a3fc0798865a29a3c578d35, March 2026), POST /stats and /upload on HTTPS port 8881 with header X-Device-UUID; resolved to 141.105.130.237 on 2026-10-13. odsj13.cc: /beacon and /result in pe_worker.js (e02855a0c4e27b793644eaf6446da9596ed8d2d3c37b580beb111738010de441, September 2026), filled in by the delivery server at serve time; behind Cloudflare. Static analysis; not contacted.