Decade-Spanning Cert Cohort Exposes Cactus's Standing Provisioning Pipeline
Four domains with nothing in common but a shared Let's Encrypt issuer, an identical 89-day certificate lifespan, and an issuance window packed into two months point to one operator running certificate issuance through a common tool. The pattern sits inside a broader 23-file, nine-domain, three-IP cluster linked in tracking to an actor recorded as 'Cactus.'
Four domains that share nothing else — not a registrar, not a top-level domain, not even a decade of age — converge on the same certificate authority, the same 89-day validity window, and an issuance timeline packed into roughly two months. 5.tipsy.co.za has been registered since 2013; presidencycollege.in surfaced in 2024 and sat dormant until this year.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read