/api/client/update?arch=amd64&commit=08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17&os=windows  -- SPARK C2 beacon POST, 185.100.87.136 FLOKINET, 1 hit this week
/eventmanager  -- SPARK C2 channel, 185.100.87.136
/ajax  -- SPARK C2 polling, 185.100.87.136
/api/v1/update  -- SPARK C2 update check, 185.100.87.136
/FD873AC4-CF86-4FED-84EC-4BD59C6F17A7  -- SPARK agent UUID path, 185.100.87.136
/images/transparentpix.gif  -- beaconing pixel, 185.100.87.136
/.env  -- env file exfil, 77.83.39.6 KPRONET/PFCLOUD, 25+ hits high-confidence malicious
/.git/HEAD  -- git metadata exfil, 77.83.39.94
/wsman  -- WinRM brute POST, 154.93.53.239 KAOPU + 179.43.185.147 PLI
/api/trpc/setup.setup  -- tRPC setup probe, 179.43.150.26 PLI
/version  -- Docker API probe, 179.43.175.56 PLI