Matching TLS services across networks do not establish shared attack control
Two IP addresses in different autonomous systems present the same HTTPS certificate and JARM fingerprint, linking their TLS service presentations. Other certificate matches in the records show why that link does not, by itself, identify an attack operator or prove command-and-control use.
Two IP addresses in different autonomous systems expose the same HTTPS certificate and the same JARM service fingerprint. The pairing of 101.198.2.228 and 101.91.111.170 raises a useful question: does that match identify common attack infrastructure, or a shared service presentation? The records supplied to CTX Threat Intelligence support the narrower finding. They connect the addresses through specific TLS characteristics, rather than merely through geography or a telecommunications provider.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read