One TLS Certificate Ties Six IPs to a Phorpiex-Tagged C2 Set
A single sslTrus-issued wildcard certificate for *.2345.com is served from six IPs across two Chinese carrier ASNs, anchoring a 24-IP, three-file Phorpiex C2 record. Most nodes score near-zero on detection, leaving certificate reuse and ASN concentration as the main evidence tying them together.
A single TLS certificate — serial d3d9e9261c1c88d957e704d69617a469, issued by sslTrus (RSA) OV CA for the wildcard subject .2345.com with SANs covering .2345.cn and *.hao774.com — is currently being served from six separate IP addresses split across two carrier networks: China Telecom Shanghai (AS4811) and the Jiangsu Wuxi International IDC network (AS138950). That is not six independently provisioned servers behind six different operators.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read