Fake uTorrent Wildcard Certificate Traces to Iceland Hosting Pair
Two IP addresses in Reykjavík, hosted by Advania Island and unrelated to BitTorrent, share an identical GoDaddy certificate impersonating *.utorrent.com. The setup gives a trojanized uTorrent installer and a 15-year-old Sality file infector a plausible-looking callback channel, while other collected indicators turn out to be unrelated shared infrastructure.
Two servers sitting on the same /19 block in Reykjavík are presenting an identical TLS certificate for a wildcard subject that has nothing to do with the network that hosts them: `.utorrent.com. The IPs — 82.221.103.245 and 82.221.103.246 — both belong to AS50613, Advania Island ehf, and both serve a GoDaddy-issued certificate carrying serial number 33902efffb1704a7, with the subject alternative names .utorrent.com and utorrent.com.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read