A 2008 Domain Wakes Up on a Contabo Asia IP
A fifteen-year-old domain, carltonbaggies.com, shares an identical TLS certificate serial with a live Contabo Asia IP, while three unrelated domains of different ages all received matching 89-day certificates within the same 2026 window. The pattern reads as templated reactivation of dormant web assets rather than a purpose-built C2 buildout, loosely tied to a decade-old bank-lure phishing kit.
A certificate serial number is not supposed to outlive a decade of digital abandonment. But that is exactly what has happened to carltonbaggies.com, a domain registered through Bluehost Inc. back on 2008-02-19 — 6,698 days of registration history that included no meaningful hosting activity worth tracking, according to the record available to CTX Team.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read