# C2 and Exploitation Paths Observed

# PFCLOUD (AS51396)
http://169.254.169.254/latest/user-data -- cloud metadata probe, 176.65.148.142, port 3001
/src/universalTouchGamepad.js -- zgrab web scanner probe, 45.135.194.31, ports 3000/3001
http://proxy.flarevpn.digital:8080/judge -- proxy-quality judge check, 45.135.194.113, port 8019

# PLI-AS (AS51852)
/.env -- environment file exfiltration, 179.43.150.26, ports 8001/8443
/.git -- git repository discovery, 179.43.150.26, ports 8001/8443
/z5044, /s/5124, /.e2382 -- randomized directory-bruteforce paths, 179.43.150.26