Dear All, As this may land slightly-off the charter of this group so off-list replies are welcome. I just want to know the credibility of the report by Citizen-Lab on FinFisher C&C servers. Some of the C&C servers are hosted in RIPE region. While checking the flow records of 2 weeks, I've seen some good number of connection to prefixes mentioned in this report out of my ISP. https://citizenlab.org/storage/finfisher/final/fortheireyesonly.pdf Regards, Aftab A. Siddiqui