Report Overview
Visitedpublic
2026-02-03 15:03:22
Submit Tags
URL
thorwap.finance/
Finishing URL
thorwap.finance/
IP / ASN
172.67.182.116
Title
THORSwap
Suspicious - Suspicious Javascript code
Detections
urlquery
2
Network Intrusion Detection
1
Threat Detection Systems
2
Host Summary
| Host | Rank | Registered | First Seen | Last Seen | Sent | Received | IP | Fingerprints |
|---|---|---|---|---|---|---|---|---|
i.ibb.co | 21643 | 2010-07-20 | 2018-11-25 | 2026-01-28 | 3.8 kB | 74 kB |  23.237.219.162 |   |
fonts.mailerlite.com | 215001 | 2010-04-09 | 2021-09-21 | 2026-01-28 | 4.2 kB | 352 kB | 172.64.150.190 |  |
assets.mailerlite.com | 182442 | 2010-04-09 | 2022-04-21 | 2026-01-28 | 2.3 kB | 151 kB | 172.64.150.190 | |
thornode.thorswap.net | 6177810 | 2021-04-11 | 2021-09-30 | 2026-02-03 | 466 B | 8.7 kB | 104.20.44.146 | |
challenges.cloudflare.com | 11393 | 2009-02-17 | 2021-10-20 | 2026-02-01 | 5.1 kB | 520 kB | 104.18.94.41 | |
assets.mlcdn.com | 190482 | 2015-01-08 | 2022-03-23 | 2026-01-29 | 897 B | 160 kB | 104.18.34.38 |    |
cca-lite.coinbase.com | 2742073 | 2011-07-02 | 2023-08-12 | 2026-01-29 | 1.0 kB | 2.5 kB | 172.64.152.241 | |
midgard-b.thorswap.net | unknown | 2021-04-11 | 2021-10-26 | 2026-02-03 | 448 B | 7.5 kB | 104.20.44.146 | |
sheets.googleapis.com | 368295 | 2005-01-25 | 2017-02-01 | 2026-02-01 | 582 B | 7.6 kB | 142.250.178.74 | |
static.thorswap.net | unknown | 2021-04-11 | 2022-06-28 | 2026-02-03 | 5.5 kB | 440 kB | 104.20.44.146 | |
www.googletagmanager.com | 283 | 2011-11-11 | 2012-10-04 | 2026-02-01 | 886 B | 748 kB | 142.250.178.104 | |
fonts.gstatic.com | unknown | 2008-02-11 | 2014-04-02 | 2026-02-01 | 3.2 kB | 110 kB | 142.250.74.3 | |
pulse.walletconnect.org | 247907 | 2018-03-26 | 2023-10-09 | 2026-01-31 | 577 B | 274 B | 172.66.157.155 | |
midgard.ninerealms.com | 1977422 | 2011-01-02 | 2021-12-02 | 2026-02-03 | 953 B | 18 kB | 104.18.25.104 |  |
thorwap.finance 1 alert(s) on this Host | unknown | unknown | 2026-02-03 | 2026-02-03 | 40 kB | 12 MB | 172.67.182.116 |     |
api.ceooflidare.icu 2 alert(s) on this Host | unknown | 2025-12-14 | 2026-01-19 | 2026-02-02 | 1.0 kB | 3.2 kB |  158.94.210.9 |   |
storage.mlcdn.com | 359260 | 2015-01-08 | 2022-01-27 | 2026-02-01 | 491 B | 17 kB | 104.18.34.38 | |
www.coindesk.com | 100071 | 2008-05-04 | 2018-11-13 | 2026-01-31 | 1.2 kB | 366 B | 104.18.23.113 |  |
groot.mailerlite.com | 352304 | 2010-04-09 | 2022-02-18 | 2026-01-30 | 962 B | 15 kB | 172.64.150.190 | |
OpenResty (Web servers)
OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.Nginx (Web servers, Reverse proxies)
Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.Cloudflare (CDN)
Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.Google Cloud CDN (CDN)
Cloud CDN uses Google's global edge network to serve content closer to users.Google Cloud Storage (Miscellaneous)
Google Cloud Storage allows world-wide storage and retrieval of any amount of data at any time.Google Cloud (IaaS)
Google Cloud is a suite of cloud computing services.Envoy (Reverse proxies)
Envoy is an open-source edge and service proxy, designed for cloud-native applications.Google Tag Manager (Tag managers)
Google Tag Manager is a tag management system (TMS) that allows you to quickly and easily update measurement codes and related code fragments collectively known as tags on your website or mobile app.Nuxt.js (JavaScript frameworks, Web frameworks, Web servers, Static site generator)
Nuxt is a Vue framework for developing modern web applications.Node.js (Programming languages)
Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.Vue.js (JavaScript frameworks)
Vue.js is an open-source model–view–viewmodel JavaScript framework for building user interfaces and single-page applications.Express (Web frameworks, Web servers)
Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.Ubuntu (Operating systems)
Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.Nginx:1.18.0 (Web servers, Reverse proxies)
Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.Vercel (PaaS)
Vercel is a cloud platform for static frontends and serverless functions.Related reports
Network Intrusion Detection Systems
Suricata /w Emerging Threats Pro
| Timestamp | Severity | Source IP | Destination IP | Alert |
|---|---|---|---|---|
| medium | Client IP | 158.94.210.9 | ET INFO Suspicious Domain (*.icu) in TLS SNI |
Threat Detection Systems
| Detection System | Indicator | Verdict | Alert |
|---|---|---|---|
| YARAhub by abuse.ch | thorwap.finance/after.js | malware | Detects file containing Telegram Bot API |
| OpenDNS | api.ceooflidare.icu | phishing | Phishing Block |
Telegram Bot detected (1)
URL
thorwap.finance/after.js
IP / ASN
172.67.182.116
Token
8208090838:AAHo4ZpN32TcBv_jdN_uRQ0-ZiBb51wakdU
Bot Overview
User ID8208090838
Usernameshushxhxjdjauth_bot
First Namee auth
Last NameN/A
Chat Info
Chat ID7775364742
Chat Typeprivate
TitleN/A
User Count2
Admins0
Pending Msgs24
JavaScript (129)
| HASH | FROM | Size | First Seen | Last Seen | |
|---|---|---|---|---|---|
| 086707e4369f60afedcafb16050a7618 | DocumentWrite | 39 B | 2023-03-07 | 2026-03-01 | |
Introduced by DocumentWrite First Seen 2023-03-07 Last Seen 2026-03-01 Times Seen 618178 Size 39 B (39 bytes) MD5 086707e4369f60afedcafb16050a7618 SHA1 8216b0cc6876cbd44f01c158e7dff3833ceccd41 Loading... | |||||
HTTP Transactions (114)
| URL | IP | Response | Size |
|---|