Shared TLS Certificate Ties Two China Telecom ASNs to One CDN Edge
A newly catalogued IP on AS134763 terminates the identical DigiCert certificate serial as a previously known node on AS4134, revealing both sit behind the same ChinaNetCenter CDN fabric rather than a purpose-built C2 network. The cross-ASN certificate match gives analysts a more durable pivot than IP address, which China Telecom rotates freely across its blocks.
The most interesting fact in this catalog isn't a file — it's a TLS certificate. Two IP addresses sitting on different China Telecom autonomous systems, 113.96.132.210 (AS4134, Chinanet) and a newly catalogued 119.147.118.106 (AS134763, CHINANET Guangdong province network), terminate the exact same certificate: serial b234dba9d0c0f44f93cd5fdc51fcfa4, issued by DigiCert Basic OV G2 TLS CN RSA4096 SHA256 2022 CA1, subject default.chinanetcenter.com.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read