git-tanstack[.]comDomain

Reported by 1 independent source · first reported 13 May 2026 by Datadog Security Labs · last reported 13 May 2026

Last reported 5 months ago

What the reports say

1 report, newest first · the exact sentence from each

“The default destination for this campaign is git-tanstack[.]com:443/router before sending, the domain sender does a DNS lookup and HTTP healthcheck (expects 400 or 404).”

Datadog Security LabsVendor13 May 2026
Shai-Hulud Goes Open Source

Indicators reported together

named in the same reports

m[.]groupin 1 report
3f3f42d072bd3686…ec0ea572eea7in 1 report
29ac906c8bd801df…278c24e4f1a7in 1 report
619c56acf572df75…2da3a44f10b4in 1 report
83.142.209[.]194in 1 report
hxxps://api.github[.]com/userin 1 report
f2157f1cecbf3995…266ad2b3d625in 1 report
77d92efe7af3547f…ac866911694din 1 report
f7a1e56b6dbd4277…615ddfee52e4in 1 report
c55a10759f6f415a…abf6d88ae492in 1 report
ab4fcadaec49c032…f2fa8601266cin 1 report
2258284d65f63829…f360bd90d3dfin 1 report

Copy these 12 indicators · defanged

12 indicators, defanged, one per line

m[.]group
3f3f42d072bd36860ab7bd7fb5e10ac0d22c741c13c89505ccd6ec0ea572eea7
29ac906c8bd801dfe1cb39596197df49f80fff2270b3e7fbab52278c24e4f1a7
619c56acf572df75b6004a6fc013c80900316a76099b241d64312da3a44f10b4
83.142.209[.]194
hxxps://api.github[.]com/user
f2157f1cecbf3995aafad750e6e805c472cec466a53d17c2063f266ad2b3d625
77d92efe7af3547f71fd41d4a884872d66b1be9499eaa637e91eac866911694d
f7a1e56b6dbd42778fe349b8412ab9749c78fa2bf41ea90b1165615ddfee52e4
c55a10759f6f415a536940a75f42aa372878a51f8eb97468551eabf6d88ae492
ab4fcadaec49c03278063dd269ea5eef82d24f2124a8e15d7b90f2fa8601266c
2258284d65f63829bd67eaba01ef6f1ada2f593f9bbe41678b2df360bd90d3df

Thanks — we review every report.

Report a wrong value