https://hunt.io/blog/tracking-shadowpad-infrastructure-via-non-standard-certificates