C&CMembers
C&CDNS links two domains to IPs; TLS fingerprints add service context
Two domain-to-IP relationships have matching TLS-service fingerprints, making the endpoints useful investigation pivots. Different certificate identities limit what those matches establish: the records do not show malicious infrastructure or command-and-control activity.
Nov 4, 2026, 17:36 (UTC+9)Last seenNov 4, 2026Severity100ByCTX TeamActorPinchy SpiderSodinokibiIOC33RegionsUS
reihtec.com resolves to 174.138.186.11, and both carry the same recorded JARM TLS-service fingerprint. A second pair, kalteng.net and 45.126.43.3, shows the same combination of an exact DNS relationship and matching fingerprints. These are concrete connections—but do they identify malicious infrastructure, or simply the services behind the names?
Members only
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to readSource: CTX Threat Intelligence