Certificate Serial Links South African IP to GoDaddy Domain
A single Let's Encrypt certificate serial ties an AFRINIC-hosted South African IP to a GoDaddy-registered domain, exposing a wider web of 29 IPs and 32 domains bound by shared cert-issuance lineages. The file layer offers almost nothing malicious — just a legitimately signed scanning tool — making certificate and hosting patterns the record's real signal.
A single TLS certificate serial number — 5ee850a60d5f88bb1442ee2acebf3310dd — is the thread that unravels this cluster. It sits on an AFRINIC-registered IP, 168.76.155.178, hosted under ASLINE LIMITED (AS137951) in South Africa, and it sits, identically, on guomcc.com, a domain registered through GoDaddy.com, LLC back in July 2024.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read