Follow-up on Russian “Host F”

Censys analysts revisited Host F (95.213.145.99), previously associated with ransomware C2 infrastructure and Bitcoin callbacks, and observed that while some ransomware-related ports were removed, the host later served Rapid7 Metasploit Pro (port 3790) alongside other tools. The report documents port history and service fingerprints, concluding the host is likely still controlled by the same operator and may have shifted from directly hosting ransomware kits to a managerial or penetration-testing/initial-access role within a broader ransomware network.