← All actors Recent activity

GREENSPOT

GREENSPOT · apt-c-01 · poison ivy

Indicators
189
Source reports
16
Activity span
not dated
Newest indicator
unknown
Upstream change
2026-01-02
20192025

Overview 189 indicators

No published description. This group is tracked by Maltrail from vendor reporting but is not named in MITRE ATT&CK, so there is no curated profile to show.

domain183GREENSPOT-domain.txt
ipv44GREENSPOT.json
url2GREENSPOT.json

Principal sources 16 reports

Ranked by how many of this actor's indicators each report brought in.

What the sources have in common — not a claim that these are the same actor. See the whole graph.

Timeline 189 indicators

Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.

  1. 90 domain1 yr ago

    hunt.io/blog/greenspot-apt-targets-163com-fake-…

    143-244-183-240.cprapid.com
    64-176-165-42.cprapid.com
    6c99b2c4cf5a.expolebanon.com
    afte856422126.com
    atrew56877.com
    avdsart.com
    bribieislandhistory.com
    buendnis-fuer-kinder.com
    center-gai.com
    chamber.icu
    chinmori.com
    cnsa163.com
    co-journal163.com
    co-journalyeah.net
    contracter.org
    daotongintelligence163.com
    datamasterw.com
    difusora890.com
    dockerswarm2.cic-webpro.com
    eadfg56877.com
    eco163.com
    eleusina.com
    esrebrenica.com
    fored126.com
    gjfgw163.com
    gottardo-fs.com
    gscmovies.com
    gxbxzszl163.com
    gzkfj20240923.com
    h2024163.com
    hcqtji.com
    hopemilltheatre.com
    hostmaster.thicongcayxanh.com.vn
    howtochoosealawschool.com
    hunter.luminousstore.cloud
    huntercomunity.pterodactyl.web.id
    im1.dewabiz.com
    intent.cyou
    janheweliusz.com
    k2024163.com
    krogoo.net
    l12254686126.com
    l12457784126.com
    l2024163.com
    l58785163.com
    l588188126.com
    l5886797126.com
    l8630639126.com
    ll63.net
    locarmi.com
    lorenlegarda.com
    m2024163.com
    mail.eco163.com
    mail.ll63.net
    mg333.co
    museeairespace.com
    nefeliishot.com
    newonelier.com
    nissantuners.com
    node.huntercomunity.pterodactyl.web.id
    nottinghamplayhouse.com
    o88252526126.com
    oneliotimes.com
    private-site163.com
    psagwadar.com
    redebrasilatual.com
    regomiba.com
    sater512368.com
    saymoil.com
    shandong163.com
    shannon-fishery-board.com
    ship5688789.com
    shiper5688163.com
    shop-dustongel.com
    solovlxx.com
    stamfordshakespeare.com
    superset.greeninvietnam.org.vn
    tanygraig.com
    technicel.vip
    technology.cyou
    telegrafonline.com
    the-real-mscleo.com
    thecatlab.space
    thisisstfc.com
    tsumada.com
    tyeeconsulting.com
    vernonmuseum.com
    worldradihistory.com
    ww2gravestoneer.com
    zilarmala.com

  2. 2 domain, 2 ipv4, 2 url2 yrs ago

    x.com/blackorbird/status/1862442853445902387 · mp.weixin.qq.com/s/6wVfE9SE3wVuazxVppe3tA · virustotal.com/gui/file/534522b87f1158f28587f82b4df590… · virustotal.com/gui/file/d3591c2f1692fd1dd582f7fb377b74…

    domaincaac-cn.com
    domaincaac-cn.org
    ipv4128.199.134.3:443
    ipv4158.247.208.174:443
    urlhttp://128.199.134.3
    urlhttp://158.247.208.174

  3. 1 domain3 yrs ago

    twitter.com/ThreatBookLabs/status/16519781284395171…

    accounts126.com

  4. 1 domain3 yrs ago

    threatbook.io/domain/download163ease.com

    download163ease.com

  5. 1 domain3 yrs ago

    twitter.com/ThreatBookLabs/status/16459868035923476…

    cloudattaches-126.com

  6. 1 domain3 yrs ago

    twitter.com/ThreatBookLabs/status/16416316967423918…

    360urlscan.com

  7. 4 domain3 yrs ago

    twitter.com/ThreatBookLabs/status/16137359973633597…

    censor.site
    certifications.services
    clouddevice.site
    clouddrive.space

  8. 1 domain5 yrs ago

    twitter.com/RedDrip7/status/1118009381679878144 · virustotal.com/gui/domain/webplurk.com/relations · virustotal.com/gui/file/b101035ae8b25263cf7101fbc63df7… · ti.360.net/uploads/2018/09/20/6f8ad451646c9eda1f75…

    webplurk.com

  9. 4 domain, 2 ipv46 yrs ago

    twitter.com/blackorbird/status/1293732897405378560 · virustotal.com/gui/file/921ceb666fcfeee6cb031b334f6552…

    domaininfluxdb.kanoak.com
    domainmonitoring.kanoak.com
    domainofficeupdate.mynetav.com
    domainwinsoftware.onedumb.com
    ipv4202.182.108.174:80
    ipv4207.148.126.90:80

  10. 76 domain7 yrs ago

    twitter.com/RedDrip7/status/1118009381679878144 · virustotal.com/gui/domain/webplurk.com/relations · virustotal.com/gui/file/b101035ae8b25263cf7101fbc63df7… · ti.360.net/uploads/2018/09/20/6f8ad451646c9eda1f75…

    126mailserver.serveftp.com
    access.webplurk.com
    aliago.dyndns.dk
    annie165.zyns.com
    as1688.webhop.org
    babana.wikaba.com
    backaaa.beijingdasihei.com
    bearingonly.rebatesrule.net
    bt0116.servebbs.net
    canberk.gecekodu.com
    ceepitbj.servepics.com
    check.blogdns.com
    china.serveblog.net
    chinamil.lflink.com
    cluster.safe360.dns05.com
    cnwww.m-music.net
    comehigh.mefound.com
    emailser163.serveusers.com
    fevupdate.ocry.com
    fff.dynamic-dns.net
    gaewaa.upgrinfo.com
    geiwoaaa.qpoe.com
    givemea.ygto.com
    givemeaaa.upgrinfo.com
    goldlion.mefound.com
    gugupd.008.net
    guliu2008.9966.org
    hy-zhqopin.mynumber.org
    hyssjc.securitytactics.com
    jason.zyns.com
    javainfo.upgrinfo.com
    jerry.jkub.com
    kav2011.mooo.com
    kouwel.zapto.org
    l63service.serveuser.com
    laizaow.mefound.com
    localhosts.ddns.us
    mail.sends.sendsmtp.com
    mail163.mypop3.net
    mailsends.sendsmtp.com
    mediatvset.no-ip.org
    microsoftword.serveuser.com
    moneyaaa.beijingdasihei.com
    motices.ourhobby.com
    mp3.dnset.com
    myaccount.emailsevr.net
    netlink.vizvaz.com
    office.go.dyndns.org
    officepatch.dnset.com
    operater.solaris.nu
    pouhui.diskstation.org
    pps.longmusic.com
    ps1688.webhop.org
    rising.linkpc.net
    safe360.dns05.com
    sandy.ourhobby.com
    service.justdied.com
    soagov.sytes.net
    soagov.zapto.org
    soasoa.sytes.net
    ssy.ikwb.com
    ssy.mynumber.org
    svcsrset.ezua.com
    teacat.https443.org
    tong.wikaba.com
    updateinfo.servegame.org
    updates.lflink.com
    usa08.serveftp.net
    uswebmail163.sendsmtp.com
    waterfall.mynumber.org
    webupdate.dnsrd.com
    winsysupdate.dynamic-dns.net
    wmiaprp.ezua.com
    wwwdo.tyur.acmetoy.com
    xinhua.redirectme.net
    zxcv201789.dynssl.com

  11. 2 domain7 yrs ago

    twitter.com/blackorbird/status/1293732897405378560 · virustotal.com/gui/file/921ceb666fcfeee6cb031b334f6552…

    app.newfacebk.com
    update.newfacebk.com

Further reading 16