DNS and certificate records link qh88eu.com to its backdoor subdomain
The two names share recorded addresses and an identical certificate, making their relationship stronger than the TLS fingerprint match they share with two other domains. That wider match is an investigative lead, not evidence of common control or observed C2 traffic.
backdoor.qh88eu.com and qh88eu.com have the same recorded IP addresses and HTTPS certificate. Two other domains share their TLS service fingerprint but have different addresses and certificates. That contrast raises the central question: how much of this apparent infrastructure cluster is actually connected? The records supplied to CTX Threat Intelligence support a specific relationship between the qh88eu.com parent domain and its backdoor subdomain. The wider grouping is less tightly linked.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read