DNS links domain to IP; matching TLS fingerprints corroborate
A supplied DNS record maps `dfkjgoi3.info` to `213.108.199.215`, while matching certificate and JARM fingerprints support the service association. The IP is a documented infrastructure pivot, but the records do not show malware communicating with it.
dfkjgoi3.info points to 213.108.199.215 in the supplied DNS record, and the two profiles report matching HTTPS certificates and JARM service fingerprints. Together, these observations answer a concrete question: is the IP merely another suspicious indicator, or does it have a documented relationship to the domain? CTX Threat Intelligence’s records support the latter. The IP is an infrastructure pivot for investigating the domain, not just a nearby entry in an indicator collection.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read