Upon navigating to this IP address, we observed an email address – tebya@poime[.]li – on the page title, the first link in the chain of attribution (Figure 14).  Using the email address as a pivot, we identified additional domains that were linked to tebya@poime[.]li.