GhostCode Harvester GeoIP API Call Enabling FlashProxy Residential Proxy

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•1

Detects network traffic associated with the GhostCode phishing kit, specifically identifying API requests to a harvester service and subsequent responses indicating the activation of FlashProxy residential proxy services. These indicators suggest an attacker is leveraging proxy infrastructure to manage command-and-control communications and mask the source of malicious activity.