Overview 152 indicators
No published description. This group is tracked by Maltrail from vendor reporting but is not named in MITRE ATT&CK, so there is no curated profile to show.
| ipv4 | 104 | UNC4841.json |
| domain | 48 | UNC4841-domain.txt |
Principal sources 8 reports
Ranked by how many of this actor's indicators each report brought in.
- 112mandiant.com/resources/blog/barracuda-esg-exploited-…
- 112mandiant.com/resources/blog/unc4841-post-barracuda-z…
- 112otx.alienvault.com/pulse/64edfc5ab93abb1407070292
- 37github.com/hagezi/dns-blocklists/issues/7271
- 37silentpush.com/blog/salt-typhoon-2025
- 2trustwave.com/en-us/resources/blogs/spiderlabs-blog/t…
- 2otx.alienvault.com/pulse/648783b6e843ce3fe69a281a
- 1dti.domaintools.com/inside-salt-typhoon-chinas-state-corpor…
Timeline 152 indicators
Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.
152 shown
No indicator matches. Only the most recent 300 are on this page — the rest are in the JSON.
-
github.com/hagezi/dns-blocklists/issues/7271 · silentpush.com/blog/salt-typhoon-2025
aar.gandhibludtric.com aria-hidden.com asparticrooftop.com caret-right.com chatscreend.com chekoodver.com cloudprocenter.com clubworkmistake.com col-lg.com colourtinctem.com componfrom.com e-forwardviewupdata.com fitbookcatwer.com fjtest-block.com followkoon.com gandhibludtric.com getdbecausehub.com hateupopred.com incisivelyfut.com junsamyoung.com lookpumrron.com morrowadded.com newhkdaily.com onlineeylity.com qatarpenble.com redbludfootvr.com requiredvalue.com ressicepro.com shalaordereport.com siderheycook.com sinceretehope.com solveblemten.com toodblackrun.com unfeelmoonvd.com verfiedoccurr.com waystrkeprosh.com xdmgwctese.com -
dti.domaintools.com/inside-salt-typhoon-chinas-state-corpor…
availabilitydesired.us -
trustwave.com/en-us/resources/blogs/spiderlabs-blog/t… · otx.alienvault.com/pulse/648783b6e843ce3fe69a281a
mx01.bestfindthetruth.com xxl17z.dnslog.cn -
mandiant.com/resources/blog/barracuda-esg-exploited-… · mandiant.com/resources/blog/unc4841-post-barracuda-z… · otx.alienvault.com/pulse/64edfc5ab93abb1407070292
domain bestfindthetruth.com domain fessionalwork.com domain gesturefavour.com domain goldenunder.com domain singamofing.com domain singnode.com domain togetheroffway.com domain troublendsef.com ipv4 101.229.146.218:443 ipv4 101.229.146.218:8080 ipv4 103.146.179.101:443 ipv4 103.146.179.101:8080 ipv4 103.27.108.62:443 ipv4 103.27.108.62:8080 ipv4 103.77.192.13:443 ipv4 103.77.192.13:8080 ipv4 103.77.192.88:443 ipv4 103.77.192.88:8080 ipv4 103.93.78.142:443 ipv4 103.93.78.142:8080 ipv4 104.156.229.226:443 ipv4 104.156.229.226:8080 ipv4 104.223.20.222:443 ipv4 104.223.20.222:8080 ipv4 107.148.149.156:8080 ipv4 107.148.219.227:443 ipv4 107.148.219.227:8080 ipv4 107.148.219.53:443 ipv4 107.148.219.54:443 ipv4 107.148.219.54:8080 ipv4 107.148.219.55:443 ipv4 107.148.219.55:8080 ipv4 107.148.223.196:443 ipv4 107.148.223.196:8080 ipv4 107.173.62.158:443 ipv4 107.173.62.158:8080 ipv4 137.175.19.25:443 ipv4 137.175.19.25:8080 ipv4 137.175.28.251:443 ipv4 137.175.28.251:8080 ipv4 137.175.30.36:443 ipv4 137.175.30.36:8080 ipv4 137.175.30.86:443 ipv4 137.175.30.86:8080 ipv4 137.175.51.147:443 ipv4 137.175.53.170:443 ipv4 137.175.53.170:8080 ipv4 137.175.53.17:443 ipv4 137.175.53.17:8080 ipv4 137.175.53.218:443 ipv4 137.175.53.218:8080 ipv4 137.175.60.252:443 ipv4 137.175.60.252:8080 ipv4 137.175.60.253:443 ipv4 137.175.60.253:8080 ipv4 137.175.78.66:443 ipv4 137.175.78.66:8080 ipv4 139.84.227.9:443 ipv4 139.84.227.9:8080 ipv4 155.94.160.72:443 ipv4 155.94.160.72:8080 ipv4 182.239.114.135:443 ipv4 182.239.114.135:8080 ipv4 182.239.114.254:443 ipv4 182.239.114.254:8080 ipv4 192.74.226.142:443 ipv4 192.74.226.142:8080 ipv4 192.74.254.229:443 ipv4 192.74.254.229:8080 ipv4 198.2.254.219:443 ipv4 198.2.254.219:8080 ipv4 198.2.254.220:443 ipv4 198.2.254.220:8080 ipv4 198.2.254.221:443 ipv4 198.2.254.221:8080 ipv4 198.2.254.222:443 ipv4 198.2.254.222:8080 ipv4 198.2.254.223:443 ipv4 198.2.254.223:8080 ipv4 199.247.23.80:443 ipv4 199.247.23.80:8080 ipv4 213.156.153.34:443 ipv4 213.156.153.34:8080 ipv4 216.238.112.82:443 ipv4 216.238.112.82:8080 ipv4 23.224.42.29:8080 ipv4 23.224.78.130:443 ipv4 23.224.78.130:8080 ipv4 23.224.78.131:443 ipv4 23.224.78.131:8080 ipv4 23.224.78.132:443 ipv4 23.224.78.132:8080 ipv4 23.224.78.133:443 ipv4 23.224.78.133:8080 ipv4 23.224.78.134:443 ipv4 23.224.78.134:8080 ipv4 37.9.35.217:443 ipv4 37.9.35.217:8080 ipv4 38.54.1.82:443 ipv4 38.54.1.82:8080 ipv4 38.54.113.205:443 ipv4 38.54.113.205:8080 ipv4 38.60.254.165:443 ipv4 38.60.254.165:8080 ipv4 45.63.76.67:443 ipv4 45.63.76.67:8080 ipv4 52.23.241.105:443 ipv4 52.23.241.105:8080 ipv4 64.176.4.234:443 ipv4 64.176.4.234:8080 ipv4 64.176.7.59:443 ipv4 64.176.7.59:8080
Further reading 8
- trustwave.com/en-us/resources/blogs/spiderlabs-blog/t…
- mandiant.com/resources/blog/barracuda-esg-exploited-…
- silentpush.com/blog/salt-typhoon-2025
- otx.alienvault.com/pulse/648783b6e843ce3fe69a281a
- otx.alienvault.com/pulse/64edfc5ab93abb1407070292
- mandiant.com/resources/blog/unc4841-post-barracuda-z…
- github.com/hagezi/dns-blocklists/issues/7271
- dti.domaintools.com/inside-salt-typhoon-chinas-state-corpor…