RCFH AiTM toolkit — Hostinger hosting IPs (Payroll Pirates / Storm-2755, low-confidence)

Filed at medium and split into its own row ON PURPOSE — do not merge it back into the domains row. An ip: term normally earns its place because it keeps firing after the operator rotates to a fresh domain on the same box, but that argument only holds for dedicated infrastructure. This is Hostinger shared hosting: the domains were all sub-ten-day Hostinger registrations, 72.62.0.181 was already serving two campaign proxies at once, and the same address will be serving unrelated paying tenants. Treat a sighting from this row as 'a Hostinger IP that once hosted this kit', which is a lead, not a verdict — read it together with whether the domains or the YARA rows also fired. Same failure mode already documented for *.host.ultaserver.net in the DOUBLECUP infra hunt and for the shared-platform-apex IoC reach problem generally. No YARA anchor on this row: the point of the row is to isolate the noisy half so it can be triaged separately. 7 filter nodes.