Hostname resolves to two IPs; fingerprint match is only a lead
The cloud-disk hostname has recorded DNS answers for two addresses, while a third IP shares its TLS service fingerprint. The match warrants comparison, but the records do not show that the third IP is a hostname destination or part of the same operational system.
The hostname 1818706573.cdn.123clouddisk.com shares a recorded TLS service fingerprint with 61.174.8.171, yet its supplied DNS answers point to two different addresses. That mismatch raises the central question: does the fingerprint identify another destination for the hostname, or simply a service worth comparing? CTX Threat Intelligence’s records establish a DNS relationship to the two returned addresses and a separate fingerprint similarity to the listed IP.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read