 | 107.172.73.152 | | |
| 131.153.38.125 | | |
| 172.245.191.17 | | |
| 185.117.75.123 | | |
| 185.140.248.17 | | |
| 185.141.26.236 | | |
| 185.14.28.10 | | |
| 185.158.113.114 (IpServer VPS used by Mamona) | | |
| 193.19.119.4 (IpServer VPS) | | |
| 194.36.190.41 | | |
| 195.123.210.174 | | |
| 195.123.220.220 | | |
| 198.12.81.50 | | |
| 2.57.149.22 | | |
| 2.57.149.231 | | |
| 2.57.149.237 | | |
| 2.57.149.25 | | |
| 40.125.65.33 | | |
| 45.10.88.124 | | |
| 45.133.1.53 | | |
| 45.138.157.211 | | |
| 45.140.146.34 | | |
| 45.140.17.23 | | |
| 45.140.17.24 | | |
| 45.140.17.40 | | |
| 45.155.249.55 | | |
| 47.103.219.77 | | |
| 51.161.42.94 | | |
| 54.39.144.250 | | |
| 66.117.37.7 | | |
| 66.220.17.157 | | |
| 87.236.146.34 | | |
| 91.243.44.63 | | |
| 92.38.135.99 | | |
| 93.189.43.3 | | |
| Actor-controlled servers | | |
| adclick.g.doubleclick.net (Google DoubleClick open redirect) | | |
| Admin panel onnx.su (API management) | | |
| Amazon S3 | | |
| ASN 140227 (Hong Kong Communications International Co., Limited) | | |
| ASN 24429 (Zhejiang Taobao Network Co., Ltd.) | | |
| ASN 3824 (Cloud Yuqu LLC) | | |
| Attacker-controlled server (longnr.com/payment/event-log.php) | | |
| Auto-Color C2 infrastructure | | |
| AWS cloud infrastructure | | |
| AWS data centers (UAE & Bahrain) | | |
| AWS S3 bucket | | |
| AWS Secure Token Service (STS) / IAM tokens (AKIA/ASIA) | | |
| BRUTED brute-forcing framework | | |
| Brute Ratel C2 (45.155.249.55) | | |
