Don’t miss the use of ngrok for tunneling here. Continue to see malicious actors use this service to hide C2 and phising site origin servers. Ngrok uses AWS IPs across multiple zones for egress NAT. I recommend sinkholing their domains across your network. ngrok[.]com ngrok[.]io ngrok-free[.]app https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/