deploy229.cehtech.net

domain resolving

Tracked by C2 Tracker · Updated as of 2026-10-07 · Whois queried 2026-10-07T14:01:13

Registration

Registrar: —
Registered: —
Expires: —

DNS

Resolves to: 104.21.37.12, 172.67.202.102
Nameservers: —
Status: —

Observed in malware

Family	Sample SHA-256	First seen
UPI OTP Stealer (provisional)	f720caa316e6…	2026-10-07

Signing certificate

Subject CN: Android
Issuer CN: Android
Valid: 2008-02-29 → 2035-07-17
Fingerprint: a40da80a59d170caa950cf15c18c454d47a39b26989d8b640ecd745ba71bf5dc

Other samples signed with this certificate? That's a lead worth checking — but not proof of a shared operator, since signing keys (and the Android debug certificate in particular) are widely reused. See the certificate page for every sample signed with it.