# E07. Configuration and infrastructure history

## Resolver evidence

The recorded payload refers to `gitlab[.]com/drop-indexing/tasks/-/raw/main/config.json` for destination configuration. The repository history also contains a separate `config-alt.json` file, but neither retained payload references it. The recovered JavaScript has a distinct hard-coded fallback address, `api.domatisc[.]ink`. This report uses saved configuration-history analysis, not a current request to GitLab. [S1, S2]

## Recorded changes

The primary history records five revisions on 26 May 2026. The initial list names `domatisc[.]ink`, `coslyintra[.]online` and `valorecuiting[.]online`; later changes add API subdomains and remove one entry. The final listed May revision contains `api.domatisc[.]ink` and `api.coslyintra[.]online`. [S1]

On 13 July at approximately 07:10 UTC, commit `c3c71d65` changes the referenced `config.json` list to `api.cklomino[.]ink` and `api.dsfmot[.]xyz`. The separate `config-alt.json` file, added on 1 June, contains `api.onoplainai[.]ink` and `api.migadyn[.]info`; client use of that file is not established. The saved table lists six `config.json` commits and one `config-alt.json` commit; repository-wide commit counts should not be treated as identical to file-specific histories. [S1]

## Hosting context

The historical synthesis assigns `207.241.172[.]222` a C2 and administration role, `170.205.31[.]182` a lure-hosting role, and `23.137.105[.]75` an earlier C2 role. These assignments combine different observation types and dates. They do not establish that every listed relationship was simultaneous or that the addresses were dedicated exclusively to one operator. E20 and E21 examine those limitations. [S2]

## Assessment and limits

Recorded changes support at least one destination rotation through mutable configuration. They do not establish client refresh frequency, cache behavior, failure handling or universal use of the same resource. Destination blocking can interrupt connections even when a resolver exists; conversely, a cached destination may remain usable after resolver access is blocked. The original assertion that domain takedowns cannot interrupt the operation is too broad.

Monitoring scripts and historical output document an observation method, not a monitoring service verified to be running today. No historical indicator in this report is presented as a current blocklist.