domain
api.348672-shakepay.com
discovered 2026-07-09
C2 / exfiltration domain shared across all three exfil paths. Impersonates the 'Shakepay' brand name but is NOT registered infrastructure of the real Shakepay (shakepay.com). Passive DNS shows Cloudflare anycast (104.21.89.51, 172.67.188.32), consistent with attacker origin-hiding behind Cloudflare. All three endpoints use the shared header X-Api-Key: 2523-5235-8564-2683-2386.
