On 13 July 2026, a GitLab commit replaced a list of server names with api.cklomino[.]ink and api.dsfmot[.]xyz (the retained repository bundle and file history are documented in E07 ). The file held configuration, not a payload. The client reads its destination from this resource; changing the server list therefore changes where an unchanged payload can connect. The payload hash stays the same. The configuration history records the changing destinations, and certificate and panel observations connect one of those domains to a historical origin address, while the historical indicator reference lists every recorded resolver value, the separate unreferenced file, related lure hosts and the limits on each IP association.

The later July installer family used a separate mechanism; its upd_m , upd_w , upda_m and upda_w droppers embedded api.aazdias[.]ink as the primary store and api.fallaazdis[.]ink as the fallback, and those values came from the recovered dropper configuration, not from the GitLab config.json…