Mail-exchanger hostname links DNS and HTTPS certificate, not mail service
DNS names `turing.lru.li` as a mail exchanger for `lru.li`, and an HTTPS certificate recorded at `49.12.115.177` contains that exact hostname. The match gives investigators a specific infrastructure lead, but without address-resolution or mail-service evidence, it does not establish the IP as a current mail endpoint.
The DNS records for lru.li name turing.lru.li as a mail exchanger. Separately, an HTTPS certificate recorded at 49.12.115.177 contains that exact hostname. The match creates a concrete infrastructure lead: a name designated to receive mail also appears in a certificate observed at a specific IP address. But does it identify the domain’s current mail server? CTX Threat Intelligence’s records support a narrower, useful finding.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read