Identical TLS Certificate Links Manila Server to Bytedance-Registered US IP
A byte-identical self-signed certificate ties a Zenlayer Philippines server to a Bytedance-registered US address, one thread in a wider web of four bulk certificate-issuance cohorts spanning Turkey, Bangladesh, Hong Kong and beyond. Analysts say the pattern points to shared provisioning tooling rather than any organizational link.
Two servers with nothing obvious in common — one sitting inside Zenlayer's Philippine address space, the other inside a block registered to Bytedance Inc. in the United States — are presenting the exact same TLS certificate. Not a similar one: byte-identical. The certificate at 156.59.113.130 (AS21859, Zenlayer Inc, Philippines) and the one at 71.18.106.229 (AS396986, Bytedance Inc., United States) share serial number 1acf3e37b37910d932ea64e6bb27615d6484c07d, an identical thumbprint, and the…
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read