One Certificate, Five Servers, Two ASNs: A Fallback C2 Fingerprint
Four IPs across Indonesia, Vietnam, and Malaysia serve the identical GlobalSign certificate for *.certfallback.com despite sitting on unrelated hosting providers, while a fifth in the Philippines carries a freshly reissued version of the same identity. None of the five trip any VirusTotal detection, leaving certificate correlation as the only signal tying the pool together.
Five IP addresses scattered across Indonesia, the Philippines, Vietnam, and Malaysia are all answering HTTPS requests with a certificate naming the same subject: *.certfallback.com. That alone would be a modest coincidence — shared wildcard certificates get resold and reused constantly in commodity hosting. What turns it into a diagnostic fingerprint is that four of those five hosts — 128.1.178.192 (Indonesia), 128.1.45.175 (Vietnam), 43.109.107.28 (Malaysia) and 155.102.33.22 (Malaysia) — are…
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read