RCFH AiTM toolkit — Hostinger hosting IPs (Payroll Pirates / Storm-2755, low-confidence)

Filed at medium and kept as its own entry on purpose. An IP term normally earns its place because it keeps firing after the operator rotates to a fresh domain on the same server, but that only holds for dedicated infrastructure. This is Hostinger shared hosting: the domains were all registered less than ten days before use, 72.62.0.181 was already serving two campaign proxies at once, and the same addresses will serve unrelated paying tenants. Treat a sighting here as 'a Hostinger IP that once hosted this kit': a lead, not a verdict. Read it together with whether the domain or YARA entries in this family also matched. No YARA anchor on this entry: its purpose is to isolate the noisy half so it can be triaged separately.