17 IPs, Three Budget Hosts, No Hardened C2 Behind KMS Lure
A Turkish-labeled pirated Windows-activation script tied to 17 IP addresses resolves into three matched VPS pairs across MEVSPACE, UK Dedicated Servers Limited, and Contabo — not a single command post. Default, expired, and self-signed certificates sit where a hardened C2 front end should be, undercutting the record's own APT40/Gozi attribution tag.
The indicator set built around a pirated Windows-activation script doesn't resolve into a single hardened command post — it resolves into three separate landlords. Cross-referencing the 17 IP addresses tied to this record turns up three matched pairs, each pair sitting on the identical autonomous system: 195.3.220.103 and 109.205.211.94 both answer from AS201814, registered to MEVSPACE sp.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read