194.38.11[.]3IP address
Reported by 1 independent source · first reported by Trend Micro Research · last reported
Last reported 5 months ago
What the reports say
1 report, newest first · the exact sentence from each-
Inside Shadow-Earth-053: A China-Aligned Cyberespionage Campaign Against Government and Defense Sectors in Asia“In mid-December 2025, SHADOW-EARTH-053 retrieved one ShadowPad sample from the IP address 194.38.11[.]3 listening on port 1790.”
Indicators reported together
named in the same reports- 4264cfb3980a068a…40e59885f5c8in 1 report
- 2e8f9fd8213d9f69…93d881c04cd2in 1 report
- 8d9433e9734dd629…d344de733c78in 1 report
- d67197bf407e74ec…7df65cf429b3in 1 report
- 141.164.46[.]77in 1 report
- 96.9.125[.]227in 1 report
- check.office365-update[.]comin 1 report
- 209.141.40[.]254in 1 report
- zimbra-beta[.]infoin 1 report
Copy these 9 indicators · defanged
Also named with it: CVE-2025-55182, CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065
Thanks — we review every report.