When a Certificate Becomes a Clue: Infrastructure Linking in the Toll Fraud Investigation
Investigations of large mobile campaigns usually rely on malware similarity. CERT Polska's 23 September 2026 report shows a different method at work: it links applications through registration records, DNS structure, object naming, code construction and a reused TLS certificate.
The method is worth reading closely, because the report also states what each link does not prove. The analysts kept assertion and inference separate throughout.
The 17 applications and the evidence tiers
The report separates confirmed capability from attribution by association. Six applications yielded toll fraud components or direct payload links. Eleven more contained malicious loaders linked to the same operation through ad destinations, hidden Android components, activation logic and infrastructure, but their final fraud modules were never recovered.
The report then adds a third tier. Ninety-eight ads for Quick Show and BlushToon came from profiles that also promoted confirmed campaign software, but both recovered APKs were comic readers with different code and infrastructure. They are evidence of advertiser account reuse, not of participation in the operation. Easy Messages Pro and Comic Reader were direct ad destinations using identical campaign assets, yet their recovered APKs contained no recognised loader.
The links that were strong enough to use
Several connection types appear repeatedly in the analysis.
Registration timing. Historical WHOIS data shows that all 20 parent domains were registered through Amazon Registrar between 10 July and 17 September 2026. Two earlier domain pairs were registered 29 and 38 seconds apart, which is consistent with automated registration. Four new parent domains used the same AWS name-server template as the 16 original domains, and their api hosts pointed at Alibaba address pairs.
Shared WHOIS field hashes. Four newly recovered parent domains had exactly the same historical hashes for the registrant organisation, phone number and address fields as piaagt[.]click, tehsnb[.]link and hsbdbv[.]link. The report notes that this is a more specific link than sharing a registrar or cloud provider.
Object naming. Eight recovered object storage objects shared the aqmu prefix with identifiers from 2115 to 2155.
Code correspondence. The Phone Cleaner Master server returned the string poirjfirenhrhfgwv_GUOJIA=999_PL260_NG621_AT232, which selected the AqMu branch for Polish devices. The resulting DEX contained 112 classes, the same count as the AqMu payload recovered from Messenger Pro, with the same package size distribution.
Shared C2 configuration. Both AqMu versions kept the fallback address 129.226.172.250 and the reporting endpoint api.appbhwljk.com/api/v3/wkev with an embedded event token, while using separate C2 configurations.
A reused certificate. The reused certificate best illustrates the method.
What the reused certificate did and did not show
VirusTotal showed an expired Let's Encrypt certificate for ablefee.wiki presented on port 443 of 47.84.77.127 on 10 September 2026:
Certificate SHA-256: 5848152508acc864869500c0dfff20723a087019eb717131dc6d7df51fbd75e6
Subject CN: ablefee.wiki
Issuer: Let's Encrypt R11
Valid from: 2025-02-06 05:00:46 UTC
Valid until: 2025-05-07 05:00:45 UTC
Observed on IP: 47.84.77.127:443, 2026-09-10
The domain does not appear in Messenger Pro code or network requests, and passive DNS does not connect it to 47.84.77.127. What mattered was the certificate hash, which VirusTotal also observed on five addresses recovered independently from related loader samples:
| IP address | Sample context | First certificate observation in VT during 2026 |
| --- | --- | --- |
| 43.98.201.44 | Earlier PDF branch | 4 May |
| 43.106.58.250 | AI Cleaner fallback | 31 August |
| 8.219.222.81 | Text Chat fallback | 8 September |
| 47.245.84.227 | Smart Clean fallback | 12 September |
| 47.84.66.120 | Frekas fallback | 14 September |
Presenting the same certificate during TLS negotiation normally requires access to the matching private key, so reuse points to shared infrastructure management. The report still qualifies the inference. Certificate reuse does not prove that one party controlled all historical servers, so no identity, nationality or location is attributed.
Checking those addresses from outside
Certificate reuse links addresses that a service search can also describe. Queries executed on 24 September 2026 between 05:13 and 05:16 UTC returned these counts:
| ZoomEye dork | Matching services |
| --- | --- |
| ip="43.98.201.44" | 1 |
| ip="43.106.58.250" | 1 |
| ip="8.219.222.81" | 5 |
| ip="47.245.84.227" | 2 |
| ip="47.84.66.120" | 1 |
| ip="43.106.56.154" | 1 |
| ip="47.84.77.127" | 2 |
| ip="129.226.172.250" | 10 |
| ip="47.84.57.5" | 38 |
| domain="ablefee.wiki" | 0 |
Ten services across the certificate-sharing addresses is consistent with dedicated infrastructure rather than shared hosting, and the zero for ablefee.wiki matches the report's statement that the domain is a passive certificate link rather than an operational host. These figures size the internet surface. They do not identify the operator and they do not confirm that any service was used against a device.
Why this method matters for defenders
Linking by infrastructure rather than by payload catches variants that change their final module, which is what happened to eleven of the applications here. It also produces links that survive code changes: registrant field hashes, object naming conventions and certificate reuse persist across builds.
The cost is that each link needs its own confidence statement. The report never merges the tiers, and it keeps the reused-certificate claim in the qualification it deserves. That discipline is the part worth copying.
Limitations
All links described here come from one primary report and one set of service queries. Ad profile names are display labels, not verified identities. The retained ad set is what the analysts could recover, and the report declines to attribute the operation.
References
- CERT Polska, "Fałszywe reklamy i złośliwe aplikacje - analiza operacji toll fraud", 23 September 2026: https://cert.pl/posts/2026/09/analiza-tollfraud/
- ZoomEye service queries executed 24 September 2026, 05:13-05:16 UTC.
Top comments (0)