This week's DPRK crates campaign ran its C2 from a plain Hostwinds VPS range (23.254.164.0/23), per Wiz. The catch when you triage that: bulk VPN/proxy lists tag whole datacenter ranges as "Commercial VPN", so the C2 box looks like just another VPN exit and gets waved through. We relabel to the real host and keep the original flag attached, so you see both. https://www.wiz.io/blog/rust-supply-chain-attack-on-arrayref-significant-overlap-with-dprk-campaigns #blueteam #threatintel #infosec