One TLS Certificate Ties Three Alibaba Cloud IPs to Fallback C2
Three Thailand-geolocated IPs under a single Alibaba Cloud ASN share one identical certificate serial for *.certfallback.com, a pattern analysts read as a purpose-built failover tier rather than coincidental shared hosting. Older cracked-software archives tagged TA505/rockloader appear in the same record but show no build or label linkage to this infrastructure.
The most concrete signal in this indicator set is not a payload — it is a certificate. Three IP addresses, 163.181.72.193, 163.181.72.200 and 163.181.72.201, all sitting inside the 163.181.72.0/23 block and geolocated to Thailand, present the identical TLS certificate serial 6696262f452fcf46b79266a8 with the identical wildcard subject *.certfallback.com.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read