Five Unrelated Domains Share One 89-Day Certificate Fingerprint
A threat-feed record pairs a well-known 2004-era SMTP worm with a cluster of five domains and IPs spread across five countries and registrars — all issued Let's Encrypt certificates with an identical 89-day lifespan within a six-week window. The cert-issuance cadence, not the malware sample, is the record's strongest signal.
Five infrastructure nodes with no obvious business relationship to one another — the domains resolvent.net, bvwebdesign.nl, platynum.ch and sjd.se, plus the bare IP 135.125.247.10 — all carry a Let's Encrypt TLS certificate with an identical 89-day validity span, and all five were issued within a six-week window between April 22 and June 8, 2026.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read