[throwawayapples]

ycxrl.com (registered at godaddy with privacy) is the command-and-control domain mentioned in the article, which currently resolves to 192.53.113.52 (Linode). DNS is run through DOMAINCONTROL.COM, which seems to be a nextcloud instance?

[palebluedot]

Looks like 139.162.63.161 may also be involved, it has the same ssh server key:

https://search.censys.io/search?q=services.ssh.server_host_k...

[perryh2]

The domaincontrol.com nameservers are operated by GoDaddy.