Fake Alibaba, UnionPay Certificates Mask C2 on China Mobile IPs
A TLS certificate naming "Alibaba (China) Technology Co., Ltd." sits identically on five China Mobile carrier IPs across two ASNs, while a separate certificate impersonates UnionPay International on a sixth address. All six score 0/89 on VirusTotal despite the coordinated cohort pattern.
A TLS certificate now circulating across five carrier-grade Chinese IP addresses lists its subject organization as "Alibaba (China) Technology Co., Ltd." — a real corporate name borrowed for infrastructure that has nothing to do with the company. The certificate, serial 6696262f452fcf46b79266a8, carries the common name *.certfallback.com and was issued by GlobalSign's GCC R46 OV TLS CA 2025, an organization-validated authority that is supposed to confirm the entity behind a certificate before…
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read