shahgrp.com - suspicious URL scan, 13 Aug 2026
MalwareAnalyzer by Cyble scanned shahgrp.com and returned a suspicious verdict (score 46), categorised as suspicious-infrastructure. The page resolved to 198.49.23.145 on Squarespace, Inc. in US. The domain was registered 121 days ago through Squarespace Domains II LLC. 4 domains and 2 IPs were contacted, over 6 HTTP requests. 1 malware sample communicates with this URL (Phishing). The request followed 1 redirect before landing. This is a point-in-time observation from 13 Aug 2026; the page may have changed since.
Scan result
- Verdict: suspicious (score 46) · Confidence 55%
- Scanned URL:
http://shahgrp.com/uploads/jabuvovuperufi.pdf - Domain: shahgrp.com · IP: 198.49.23.145 · AS53831 · US
- Server: Squarespace
- Page title: Coming Soon
- HTTP status: 200 · text/html;charset=utf-8
- Registrar: Squarespace Domains II LLC · domain age 121 days · created 2026-04-13
- TLS issuer: C=US, O=Let's Encrypt, CN=YR2 · valid to Nov 4 16: · subject CN=shahgrp.com
- HTTP requests captured: 6
- Scan tier: fast · observed 2026-08-13 05:43:02 UTC
Redirect chain
http://shahgrp.com/uploads/jabuvovuperufi.pdfhttps://shahgrp.com/uploads/jabuvovuperufi.pdf
Malware communicating with this URL (1)
These samples were observed contacting or being served from shahgrp.com. Each links to its full analysis.
- Phishing - referenced ·
95e0e5faec3c3fdcfac43c0ec59e8b46· first seen 2026-08-13
Antivirus & YARA (1 of 44 engines)
- YARA: Trellix/McAfee ATR [yara]: ATR_REvil_Sodinokibi (page content)
These signatures matched text in the page. Pages that quote or document malware can match them, so on their own they do not make a page malicious.
Categories
- suspicious-infrastructure
Why this verdict
- Antivirus/YARA detection in page content: ATR_REvil_Sodinokibi
- Algorithmically-generated (DGA-like) hostname
- Valid TLS, no impersonation or off-origin credential post
Contacted infrastructure
- 198.49.23.145 - AS53831 Squarespace, Inc. (United States)
- 198.49.23.144 - AS53831 Squarespace, Inc. (United States)
Observed indicators
- shahgrp.com
- fonts.googleapis.com
- assets.squarespace.com
- www.squarespace.com
- 198.49.23.145
- 198.49.23.144
- https://shahgrp.com/uploads/jabuvovuperufi.pdf
- https://fonts.googleapis.com/css?family=Montserrat
- https://assets.squarespace.com/@sqs/polyfiller/1.6/legacy.js
- https://assets.squarespace.com/@sqs/polyfiller/1.6/modern.js
- https://assets.squarespace.com/universal/scripts-compressed/extract-css-runtime-2c4dbf11bd209281-min.en-US.js
- https://assets.squarespace.com/universal/scripts-compressed/extract-css-moment-js-vendor-a5cfdec1ae227f33-min.en-US.js
- https://assets.squarespace.com/universal/scripts-compressed/cldr-resource-pack-22bdf933fb74be0d-min.en-US.js
- https://assets.squarespace.com/universal/scripts-compressed/parking-page-a97f1f8a9ef0463e-min.en-US.js
- https://assets.squarespace.com/universal/styles-compressed/parking-page-32145bd77d42b5ff-min.en-US.css
- https://assets.squarespace.com/universal/images-v6/parking-page/backgrounds/img101-landscape.jpg
- http://www.squarespace.com/
- https://assets.squarespace.com/universal/images-v6/damask/logo-light.svg
Other scans of shahgrp.com (3)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 21 Aug 2026 - unknown ·
https://shahgrp.com/uploads/12026108611.pdf - 13 Aug 2026 - suspicious
- 3 Aug 2026 - unknown ·
https://shahgrp.com/uploads/40785259133.pdf
Questions about shahgrp.com
- Is shahgrp.com safe?
- No. MalwareAnalyzer scanned shahgrp.com on 13 Aug 2026 and returned a suspicious verdict with a score of 46 out of 100, categorised as suspicious-infrastructure. Treat it as hostile until it is re-checked.
- What malware is associated with shahgrp.com?
- 1 analysed samples communicate with this URL, including Phishing.
- How was shahgrp.com checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of shahgrp.com
Scanned on MalwareAnalyzer by Cyble · Open interactive scan