When I visit https://184.108.40.206, any web browser I use considers the URL to be secure.
This is what Google Chrome shows:
Normally, when I try to visit an HTTPS site via its IP address, I get a security warning like this:
From my understanding, the site certificate needs to match the domain, but the Google Chrome Certificate Viewer does not show
No - we no longer accept certificate requests for either intranet names or IP addresses. This is an industry-wide standard, not one specific to GoDaddy.
As a result, effective October 1, 2016, Certification Authorities (CAs) must revoke SSL certificates that use intranet names or IP addresses.
Instead of securing IP addresses and intranet names, you should reconfigure servers to use Fully Qualified Domain Names (FQDNs), such as www.coolexample.com.
It's well after the mandatory revocation date 01 October 2016, yet the certificate for
220.127.116.11 was issued on 29 March 2018 (shown in the screenshot above).
How is it possible that all the major browsers think that https://18.104.22.168 is a trusted HTTPS website?