UnionPay-Named TLS Certificate Found Reused Across Three Chinese ISPs
A single certificate presenting a UnionPay International subject line is live on three IPs across three separate Chinese autonomous systems, none affiliated with UnionPay. The reuse points to a shared backend fronting infrastructure that appears organizationally distinct from the outside.
A single TLS certificate presenting the subject line `*.unionpayintl.com is now live on three IP addresses spread across three separate Chinese autonomous systems — 61.160.230.232 on AS140293 (CHINATELECOM Jiangsu province Changzhou 5G network), 58.216.102.31 on AS134769 (ChinaNet Jiangsu Changzhou Liyang IDC network), and 218.92.141.107 on AS4134 (Chinanet).
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read