← All actors Recent activity

USH

USH · unfading sea haze

Indicators
65
Source reports
1
Activity span
not dated
Newest indicator
unknown
Upstream change
2026-01-02

Overview 65 indicators

No published description. This group is tracked by Maltrail from vendor reporting but is not named in MITRE ATT&CK, so there is no curated profile to show.

domain41USH-domain.txt
ipv422USH.json
url2USH.json

Principal sources 1 reports

Ranked by how many of this actor's indicators each report brought in.

Timeline 65 indicators

Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.

  1. 8 domain2 yrs ago

    blogapp.bitdefender.com/labs/content/files/2024/05/Bitdefender-…

    adswt.com
    babystats.dnset.com
    bomloginset.com
    consilium.dnset.com
    ns2.theworkguyoo.com
    pcygphil.com
    simpletra.com
    theworkguyoo.com

  2. 33 domain, 22 ipv4, 2 url2 yrs ago

    blogapp.bitdefender.com/labs/content/files/2024/05/Bitdefender-…

    domainairst.giize.com
    domainapi.bitdefenderupdate.org
    domainapi.simpletra.com
    domainauth.bitdefenderupdate.com
    domainbit.kozow.com
    domainbitdefenderupdate.com
    domainbitdefenderupdate.org
    domaincdn.g8z.net
    domaindns-log.d-n-s.org.uk
    domaindns.g8z.net
    domainemployee.mywire.org
    domainfc.adswt.com
    domainhelpdesk.fxnxs.com
    domainimages.emldn.com
    domainlink.theworkguyoo.com
    domainlinklab.blinklab.com
    domainloadviber.webredirect.org
    domainmail.adswt.com
    domainmail.bomloginset.com
    domainmail.pcygphil.com
    domainmail.simpletra.com
    domainmail.theworkguyoo.com
    domainmanags.twilightparadox.com
    domainmessage.ooguy.com
    domainnews.nevuer.com
    domainnewy.hifiliving.com
    domainpayroll.mywire.org
    domainprovider.giize.com
    domainrest.redirectme.net
    domainsopho.kozow.com
    domainspcg.lunaticfridge.com
    domainupupdate.ooguy.com
    domainword.emldn.com
    ipv4139.180.216.33:21
    ipv4139.180.221.55:21
    ipv4139.59.61.42:21
    ipv4142.93.80.236:21
    ipv4143.198.80.75:21
    ipv4146.185.136.221:21
    ipv4152.89.161.26:21
    ipv4154.90.34.83:445
    ipv4165.22.104.184:21
    ipv4165.232.84.56:21
    ipv4167.99.222.58:21
    ipv4178.128.19.134:21
    ipv4185.195.237.114:21
    ipv4185.198.57.135:21
    ipv4185.244.129.60:21
    ipv4185.244.130.34:21
    ipv4194.5.250.54:21
    ipv4206.189.153.85:21
    ipv445.32.125.175:21
    ipv468.183.185.80:21
    ipv491.235.143.251:21
    ipv495.216.63.54:21
    urlhttp://139.180.216.33
    urlhttp://154.90.34.83

Further reading 1