This is exactly the reason why I flag Routerhosting abuse.
I mention that I see tons of malware online and the CEO comes in with a “We respect the users privacy” incase of actually handling the abuse being flagged for weeks on end.
@skocherhan@gitlab nice find this makes multiple get requests to telegram channels with bios containing the domain used to exfil data to angry-toaster[.]com which would be the IOC.