Mail hostname has a historical HTTPS footprint, not a malware link
A hostname designated to receive mail for `lru.li` also appeared on an HTTPS certificate observed at `49.12.115.177`, giving investigators a specific historical infrastructure lead. The records do not establish that the address is a current mail endpoint or that the malicious executable used it.
The hostname turing.lru.li appears in two different roles in records reviewed by CTX Threat Intelligence: as a mail exchanger for lru.li, and as the name on an HTTPS certificate observed at 49.12.115.177. That match gives the IP a specific investigative context. But does it identify a mail server used by the malicious executable supplied alongside these records? The evidence supports a narrower finding.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read