Shared DNS settings link two domains; a TLS match links a different pair
Records place mrodularmall.top in two separate comparisons: it shares DNS and mail settings with crosshairc.life, while its TLS service fingerprint matches gunlovers.top. Those overlaps offer investigative leads, but do not establish one infrastructure cluster or a command-and-control network.
mrodularmall.top shares its recorded nameserver set and SPF text with crosshairc.life, but its recorded TLS service fingerprint matches a different domain: gunlovers.top. Does that make the three hosts one infrastructure cluster? CTX Threat Intelligence’s records support a narrower, more useful finding: mrodularmall.top is a pivot between two distinct infrastructure comparisons, not a demonstrated link in a command-and-control network.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read