Same-Second Certificate Reuse Exposes a Templated Provisioning Habit
A self-signed TLS certificate with serial "1" was issued at the exact same second on two unrelated domains registered two and a half years apart, and a second exact-serial match ties a Georgian domain to a Tbilisi hosting IP. The pattern points to automated cert-provisioning tooling rather than a bespoke build.
A self-signed TLS certificate carrying serial number "1" was issued at 2025-09-03 05:55:01 — and only that exact second — on two domains that have nothing else in common on paper: bijibali.com, registered 2023-08-26, and inspiringgemsshop.com, registered 2026-02-11, roughly two and a half years apart. Both certificates share an identical thumbprint and the same placeholder issuer and subject line, "localhost." That is not a coincidence of timing; a certificate minted at one instant cannot…
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read