go.getblock[.]ioDomain

Reported by 1 independent source · first reported 6 Aug 2026 by Elastic Security Labs · last reported 6 Aug 2026

Last reported 2 months ago

What the reports say

1 report, newest first · the exact sentence from each

“| WHERE dns.question.name IN ("go.getblock[.]io", "eth.llamarpc.com", "npm-cache.com", "eth-mainnet.nodereal.io", "awqhnjewqjkl.icu"”

Elastic Security LabsVendor6 Aug 2026
Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages

Indicators reported together

named in the same reports

npm-cache[.]comin 1 report
awqhnjewqjkl[.]icuin 1 report
logs-endpoint.events[.]networkin 1 report
eth-mainnet.nodereal[.]ioin 1 report
9fc2570b7cef51c1…fc2509cf1bccin 1 report
fd3ca4007b225fdf…806e5684b1ebin 1 report
54dc7ea54a1317cc…93012b350668in 1 report

Copy these 7 indicators · defanged

7 indicators, defanged, one per line

npm-cache[.]com
awqhnjewqjkl[.]icu
logs-endpoint.events[.]network
eth-mainnet.nodereal[.]io
9fc2570b7cef51c1b8df116d144d11ff4096357be7d2c4c6367cfc2509cf1bcc
fd3ca4007b225fdf8de7af4345a19179d5efa8c4bb9205f88cda806e5684b1eb
54dc7ea54a1317cca0e890a2770630cf7fa6c97813e0cb9d2caa93012b350668

Thanks — we review every report.

Report a wrong value