{ "aliases": [ "SALTWATER", "SEASIDE", "SEASPY" ], "attack_id": null, "attack_name": null, "attack_url": null, "counts": { "domain": 48, "ipv4": 104 }, "first_seen": { "domain": { "aar.gandhibludtric.com": "2026-01-02", "aria-hidden.com": "2026-01-02", "asparticrooftop.com": "2026-01-02", "availabilitydesired.us": "2026-01-02", "bestfindthetruth.com": "2023-06-17", "caret-right.com": "2026-01-02", "chatscreend.com": "2026-01-02", "chekoodver.com": "2026-01-02", "cloudprocenter.com": "2026-01-02", "clubworkmistake.com": "2026-01-02", "col-lg.com": "2026-01-02", "colourtinctem.com": "2026-01-02", "componfrom.com": "2026-01-02", "e-forwardviewupdata.com": "2026-01-02", "fessionalwork.com": "2023-06-17", "fitbookcatwer.com": "2026-01-02", "fjtest-block.com": "2026-01-02", "followkoon.com": "2026-01-02", "gandhibludtric.com": "2026-01-02", "gesturefavour.com": "2023-06-17", "getdbecausehub.com": "2026-01-02", "goldenunder.com": "2023-06-17", "hateupopred.com": "2026-01-02", "incisivelyfut.com": "2026-01-02", "junsamyoung.com": "2026-01-02", "lookpumrron.com": "2026-01-02", "morrowadded.com": "2026-01-02", "mx01.bestfindthetruth.com": "2023-08-05", "newhkdaily.com": "2026-01-02", "onlineeylity.com": "2026-01-02", "qatarpenble.com": "2026-01-02", "redbludfootvr.com": "2026-01-02", "requiredvalue.com": "2026-01-02", "ressicepro.com": "2026-01-02", "shalaordereport.com": "2026-01-02", "siderheycook.com": "2026-01-02", "sinceretehope.com": "2026-01-02", "singamofing.com": "2023-06-17", "singnode.com": "2023-06-17", "solveblemten.com": "2026-01-02", "togetheroffway.com": "2023-06-17", "toodblackrun.com": "2026-01-02", "troublendsef.com": "2023-06-17", "unfeelmoonvd.com": "2026-01-02", "verfiedoccurr.com": "2026-01-02", "waystrkeprosh.com": "2026-01-02", "xdmgwctese.com": "2026-01-02", "xxl17z.dnslog.cn": "2023-08-05" }, "ipv4": { "101.229.146.218:443": "2023-06-17", "101.229.146.218:8080": "2023-06-17", "103.146.179.101:443": "2023-06-17", "103.146.179.101:8080": "2023-06-17", "103.27.108.62:443": "2023-06-17", "103.27.108.62:8080": "2023-06-17", "103.77.192.13:443": "2023-06-17", "103.77.192.13:8080": "2023-06-17", "103.77.192.88:443": "2023-06-17", "103.77.192.88:8080": "2023-06-17", "103.93.78.142:443": "2023-06-17", "103.93.78.142:8080": "2023-06-17", "104.156.229.226:443": "2023-06-17", "104.156.229.226:8080": "2023-06-17", "104.223.20.222:443": "2023-06-17", "104.223.20.222:8080": "2023-06-17", "107.148.149.156:8080": "2023-06-17", "107.148.219.227:443": "2023-06-17", "107.148.219.227:8080": "2023-06-17", "107.148.219.53:443": "2023-06-17", "107.148.219.54:443": "2023-06-17", "107.148.219.54:8080": "2023-06-17", "107.148.219.55:443": "2023-06-17", "107.148.219.55:8080": "2023-06-17", "107.148.223.196:443": "2023-06-17", "107.148.223.196:8080": "2023-06-17", "107.173.62.158:443": "2023-06-17", "107.173.62.158:8080": "2023-06-17", "137.175.19.25:443": "2023-06-17", "137.175.19.25:8080": "2023-06-17", "137.175.28.251:443": "2023-06-17", "137.175.28.251:8080": "2023-06-17", "137.175.30.36:443": "2023-06-17", "137.175.30.36:8080": "2023-06-17", "137.175.30.86:443": "2023-06-17", "137.175.30.86:8080": "2023-06-17", "137.175.51.147:443": "2023-06-17", "137.175.53.170:443": "2023-06-17", "137.175.53.170:8080": "2023-06-17", "137.175.53.17:443": "2023-06-17", "137.175.53.17:8080": "2023-06-17", "137.175.53.218:443": "2023-06-17", "137.175.53.218:8080": "2023-06-17", "137.175.60.252:443": "2023-06-17", "137.175.60.252:8080": "2023-06-17", "137.175.60.253:443": "2023-06-17", "137.175.60.253:8080": "2023-06-17", "137.175.78.66:443": "2023-06-17", "137.175.78.66:8080": "2023-06-17", "139.84.227.9:443": "2023-06-17", "139.84.227.9:8080": "2023-06-17", "155.94.160.72:443": "2023-06-17", "155.94.160.72:8080": "2023-06-17", "182.239.114.135:443": "2023-06-17", "182.239.114.135:8080": "2023-06-17", "182.239.114.254:443": "2023-06-17", "182.239.114.254:8080": "2023-06-17", "192.74.226.142:443": "2023-06-17", "192.74.226.142:8080": "2023-06-17", "192.74.254.229:443": "2023-06-17", "192.74.254.229:8080": "2023-06-17", "198.2.254.219:443": "2023-06-17", "198.2.254.219:8080": "2023-06-17", "198.2.254.220:443": "2023-06-17", "198.2.254.220:8080": "2023-06-17", "198.2.254.221:443": "2023-06-17", "198.2.254.221:8080": "2023-06-17", "198.2.254.222:443": "2023-06-17", "198.2.254.222:8080": "2023-06-17", "198.2.254.223:443": "2023-06-17", "198.2.254.223:8080": "2023-06-17", "199.247.23.80:443": "2023-06-17", "199.247.23.80:8080": "2023-06-17", "213.156.153.34:443": "2023-06-17", "213.156.153.34:8080": "2023-06-17", "216.238.112.82:443": "2023-06-17", "216.238.112.82:8080": "2023-06-17", "23.224.42.29:8080": "2023-06-17", "23.224.78.130:443": "2023-06-17", "23.224.78.130:8080": "2023-06-17", "23.224.78.131:443": "2023-06-17", "23.224.78.131:8080": "2023-06-17", "23.224.78.132:443": "2023-06-17", "23.224.78.132:8080": "2023-06-17", "23.224.78.133:443": "2023-06-17", "23.224.78.133:8080": "2023-06-17", "23.224.78.134:443": "2023-06-17", "23.224.78.134:8080": "2023-06-17", "37.9.35.217:443": "2023-06-17", "37.9.35.217:8080": "2023-06-17", "38.54.1.82:443": "2023-06-17", "38.54.1.82:8080": "2023-06-17", "38.54.113.205:443": "2023-06-17", "38.54.113.205:8080": "2023-06-17", "38.60.254.165:443": "2023-06-17", "38.60.254.165:8080": "2023-06-17", "45.63.76.67:443": "2023-06-17", "45.63.76.67:8080": "2023-06-17", "52.23.241.105:443": "2023-06-17", "52.23.241.105:8080": "2023-06-17", "64.176.4.234:443": "2023-06-17", "64.176.4.234:8080": "2023-06-17", "64.176.7.59:443": "2023-06-17", "64.176.7.59:8080": "2023-06-17" } }, "first_seen_precision": { "domain": { "aar.gandhibludtric.com": "at-or-before", "aria-hidden.com": "at-or-before", "asparticrooftop.com": "at-or-before", "availabilitydesired.us": "at-or-before", "caret-right.com": "at-or-before", "chatscreend.com": "at-or-before", "chekoodver.com": "at-or-before", "cloudprocenter.com": "at-or-before", "clubworkmistake.com": "at-or-before", "col-lg.com": "at-or-before", "colourtinctem.com": "at-or-before", "componfrom.com": "at-or-before", "e-forwardviewupdata.com": "at-or-before", "fitbookcatwer.com": "at-or-before", "fjtest-block.com": "at-or-before", "followkoon.com": "at-or-before", "gandhibludtric.com": "at-or-before", "getdbecausehub.com": "at-or-before", "hateupopred.com": "at-or-before", "incisivelyfut.com": "at-or-before", "junsamyoung.com": "at-or-before", "lookpumrron.com": "at-or-before", "morrowadded.com": "at-or-before", "newhkdaily.com": "at-or-before", "onlineeylity.com": "at-or-before", "qatarpenble.com": "at-or-before", "redbludfootvr.com": "at-or-before", "requiredvalue.com": "at-or-before", "ressicepro.com": "at-or-before", "shalaordereport.com": "at-or-before", "siderheycook.com": "at-or-before", "sinceretehope.com": "at-or-before", "solveblemten.com": "at-or-before", "toodblackrun.com": "at-or-before", "unfeelmoonvd.com": "at-or-before", "verfiedoccurr.com": "at-or-before", "waystrkeprosh.com": "at-or-before", "xdmgwctese.com": "at-or-before" }, "ipv4": {} }, "first_seen_range": { "earliest": "2023-06-17", "latest": "2026-01-02" }, "generated_at": "2026-08-08T03:26:30+00:00", "indicators": { "domain": [ "aar.gandhibludtric.com", "aria-hidden.com", "asparticrooftop.com", "availabilitydesired.us", "bestfindthetruth.com", "caret-right.com", "chatscreend.com", "chekoodver.com", "cloudprocenter.com", "clubworkmistake.com", "col-lg.com", "colourtinctem.com", "componfrom.com", "e-forwardviewupdata.com", "fessionalwork.com", "fitbookcatwer.com", "fjtest-block.com", "followkoon.com", "gandhibludtric.com", "gesturefavour.com", "getdbecausehub.com", "goldenunder.com", "hateupopred.com", "incisivelyfut.com", "junsamyoung.com", "lookpumrron.com", "morrowadded.com", "mx01.bestfindthetruth.com", "newhkdaily.com", "onlineeylity.com", "qatarpenble.com", "redbludfootvr.com", "requiredvalue.com", "ressicepro.com", "shalaordereport.com", "siderheycook.com", "sinceretehope.com", "singamofing.com", "singnode.com", "solveblemten.com", "togetheroffway.com", "toodblackrun.com", "troublendsef.com", "unfeelmoonvd.com", "verfiedoccurr.com", "waystrkeprosh.com", "xdmgwctese.com", "xxl17z.dnslog.cn" ], "ipv4": [ "101.229.146.218:443", "101.229.146.218:8080", "103.146.179.101:443", "103.146.179.101:8080", "103.27.108.62:443", "103.27.108.62:8080", "103.77.192.13:443", "103.77.192.13:8080", "103.77.192.88:443", "103.77.192.88:8080", "103.93.78.142:443", "103.93.78.142:8080", "104.156.229.226:443", "104.156.229.226:8080", "104.223.20.222:443", "104.223.20.222:8080", "107.148.149.156:8080", "107.148.219.227:443", "107.148.219.227:8080", "107.148.219.53:443", "107.148.219.54:443", "107.148.219.54:8080", "107.148.219.55:443", "107.148.219.55:8080", "107.148.223.196:443", "107.148.223.196:8080", "107.173.62.158:443", "107.173.62.158:8080", "137.175.19.25:443", "137.175.19.25:8080", "137.175.28.251:443", "137.175.28.251:8080", "137.175.30.36:443", "137.175.30.36:8080", "137.175.30.86:443", "137.175.30.86:8080", "137.175.51.147:443", "137.175.53.170:443", "137.175.53.170:8080", "137.175.53.17:443", "137.175.53.17:8080", "137.175.53.218:443", "137.175.53.218:8080", "137.175.60.252:443", "137.175.60.252:8080", "137.175.60.253:443", "137.175.60.253:8080", "137.175.78.66:443", "137.175.78.66:8080", "139.84.227.9:443", "139.84.227.9:8080", "155.94.160.72:443", "155.94.160.72:8080", "182.239.114.135:443", "182.239.114.135:8080", "182.239.114.254:443", "182.239.114.254:8080", "192.74.226.142:443", "192.74.226.142:8080", "192.74.254.229:443", "192.74.254.229:8080", "198.2.254.219:443", "198.2.254.219:8080", "198.2.254.220:443", "198.2.254.220:8080", "198.2.254.221:443", "198.2.254.221:8080", "198.2.254.222:443", "198.2.254.222:8080", "198.2.254.223:443", "198.2.254.223:8080", "199.247.23.80:443", "199.247.23.80:8080", "213.156.153.34:443", "213.156.153.34:8080", "216.238.112.82:443", "216.238.112.82:8080", "23.224.42.29:8080", "23.224.78.130:443", "23.224.78.130:8080", "23.224.78.131:443", "23.224.78.131:8080", "23.224.78.132:443", "23.224.78.132:8080", "23.224.78.133:443", "23.224.78.133:8080", "23.224.78.134:443", "23.224.78.134:8080", "37.9.35.217:443", "37.9.35.217:8080", "38.54.1.82:443", "38.54.1.82:8080", "38.54.113.205:443", "38.54.113.205:8080", "38.60.254.165:443", "38.60.254.165:8080", "45.63.76.67:443", "45.63.76.67:8080", "52.23.241.105:443", "52.23.241.105:8080", "64.176.4.234:443", "64.176.4.234:8080", "64.176.7.59:443", "64.176.7.59:8080" ] }, "last_modified": "2026-01-02T23:10:15+00:00", "maltrail_groups": [ "UNC4841" ], "references": [ "https://dti.domaintools.com/inside-salt-typhoon-chinas-state-corporate-advanced-persistent-threat/", "https://github.com/hagezi/dns-blocklists/issues/7271", "https://otx.alienvault.com/pulse/648783b6e843ce3fe69a281a", "https://otx.alienvault.com/pulse/64edfc5ab93abb1407070292", "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally", "https://www.mandiant.com/resources/blog/unc4841-post-barracuda-zero-day-remediation", "https://www.silentpush.com/blog/salt-typhoon-2025/", "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trustwave-action-response-zero-day-vulnerability-in-barracuda-email-security-gateway-appliance-esg-cve-2023-2868/" ], "related": [], "slug": "UNC4841", "timeline": [ { "counts": { "domain": 37 }, "first_seen": "2026-01-02", "indicators": { "domain": [ "aar.gandhibludtric.com", "aria-hidden.com", "asparticrooftop.com", "caret-right.com", "chatscreend.com", "chekoodver.com", "cloudprocenter.com", "clubworkmistake.com", "col-lg.com", "colourtinctem.com", "componfrom.com", "e-forwardviewupdata.com", "fitbookcatwer.com", "fjtest-block.com", "followkoon.com", "gandhibludtric.com", "getdbecausehub.com", "hateupopred.com", "incisivelyfut.com", "junsamyoung.com", "lookpumrron.com", "morrowadded.com", "newhkdaily.com", "onlineeylity.com", "qatarpenble.com", "redbludfootvr.com", "requiredvalue.com", "ressicepro.com", "shalaordereport.com", "siderheycook.com", "sinceretehope.com", "solveblemten.com", "toodblackrun.com", "unfeelmoonvd.com", "verfiedoccurr.com", "waystrkeprosh.com", "xdmgwctese.com" ] }, "precision": "at-or-before", "references": [ "https://github.com/hagezi/dns-blocklists/issues/7271", "https://www.silentpush.com/blog/salt-typhoon-2025/" ], "total": 37 }, { "counts": { "domain": 1 }, "first_seen": "2026-01-02", "indicators": { "domain": [ "availabilitydesired.us" ] }, "precision": "at-or-before", "references": [ "https://dti.domaintools.com/inside-salt-typhoon-chinas-state-corporate-advanced-persistent-threat/" ], "total": 1 }, { "counts": { "domain": 2 }, "first_seen": "2023-08-05", "indicators": { "domain": [ "mx01.bestfindthetruth.com", "xxl17z.dnslog.cn" ] }, "precision": "exact", "references": [ "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trustwave-action-response-zero-day-vulnerability-in-barracuda-email-security-gateway-appliance-esg-cve-2023-2868/", "https://otx.alienvault.com/pulse/648783b6e843ce3fe69a281a" ], "total": 2 }, { "counts": { "domain": 8, "ipv4": 104 }, "first_seen": "2023-06-17", "indicators": { "domain": [ "bestfindthetruth.com", "fessionalwork.com", "gesturefavour.com", "goldenunder.com", "singamofing.com", "singnode.com", "togetheroffway.com", "troublendsef.com" ], "ipv4": [ "101.229.146.218:443", "101.229.146.218:8080", "103.146.179.101:443", "103.146.179.101:8080", "103.27.108.62:443", "103.27.108.62:8080", "103.77.192.13:443", "103.77.192.13:8080", "103.77.192.88:443", "103.77.192.88:8080", "103.93.78.142:443", "103.93.78.142:8080", "104.156.229.226:443", "104.156.229.226:8080", "104.223.20.222:443", "104.223.20.222:8080", "107.148.149.156:8080", "107.148.219.227:443", "107.148.219.227:8080", "107.148.219.53:443", "107.148.219.54:443", "107.148.219.54:8080", "107.148.219.55:443", "107.148.219.55:8080", "107.148.223.196:443", "107.148.223.196:8080", "107.173.62.158:443", "107.173.62.158:8080", "137.175.19.25:443", "137.175.19.25:8080", "137.175.28.251:443", "137.175.28.251:8080", "137.175.30.36:443", "137.175.30.36:8080", "137.175.30.86:443", "137.175.30.86:8080", "137.175.51.147:443", "137.175.53.170:443", "137.175.53.170:8080", "137.175.53.17:443", "137.175.53.17:8080", "137.175.53.218:443", "137.175.53.218:8080", "137.175.60.252:443", "137.175.60.252:8080", "137.175.60.253:443", "137.175.60.253:8080", "137.175.78.66:443", "137.175.78.66:8080", "139.84.227.9:443", "139.84.227.9:8080", "155.94.160.72:443", "155.94.160.72:8080", "182.239.114.135:443", "182.239.114.135:8080", "182.239.114.254:443", "182.239.114.254:8080", "192.74.226.142:443", "192.74.226.142:8080", "192.74.254.229:443", "192.74.254.229:8080", "198.2.254.219:443", "198.2.254.219:8080", "198.2.254.220:443", "198.2.254.220:8080", "198.2.254.221:443", "198.2.254.221:8080", "198.2.254.222:443", "198.2.254.222:8080", "198.2.254.223:443", "198.2.254.223:8080", "199.247.23.80:443", "199.247.23.80:8080", "213.156.153.34:443", "213.156.153.34:8080", "216.238.112.82:443", "216.238.112.82:8080", "23.224.42.29:8080", "23.224.78.130:443", "23.224.78.130:8080", "23.224.78.131:443", "23.224.78.131:8080", "23.224.78.132:443", "23.224.78.132:8080", "23.224.78.133:443", "23.224.78.133:8080", "23.224.78.134:443", "23.224.78.134:8080", "37.9.35.217:443", "37.9.35.217:8080", "38.54.1.82:443", "38.54.1.82:8080", "38.54.113.205:443", "38.54.113.205:8080", "38.60.254.165:443", "38.60.254.165:8080", "45.63.76.67:443", "45.63.76.67:8080", "52.23.241.105:443", "52.23.241.105:8080", "64.176.4.234:443", "64.176.4.234:8080", "64.176.7.59:443", "64.176.7.59:8080" ] }, "precision": "exact", "references": [ "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally", "https://www.mandiant.com/resources/blog/unc4841-post-barracuda-zero-day-remediation", "https://otx.alienvault.com/pulse/64edfc5ab93abb1407070292" ], "total": 112 } ] }