| Date | IP Address |
| 2020-04-09 | 13.226.182.33 (ClassC) |
| 2020-07-31 | 13.226.96.183 (ClassC) |
| 2020-07-31 | 13.226.96.223 (ClassC) |
| 2020-08-01 | 13.32.196.68 (ClassC) |
| 2020-08-05 | 13.249.105.185 (ClassC) |
| 2020-08-05 | 13.226.103.148 (ClassC) |
| 2020-08-12 | 13.249.29.67 (ClassC) |
| 2020-08-22 | 13.249.112.131 (ClassC) |
| 2020-08-22 | 13.249.112.190 (ClassC) |
| 2020-11-05 | 13.249.126.138 (ClassC) |
| 2020-11-05 | 13.249.126.72 (ClassC) |
| 2020-11-05 | 99.84.216.130 (ClassC) |
| 2020-11-05 | 13.249.126.123 (ClassC) |
| 2020-11-14 | 13.249.105.204 (ClassC) |
| 2025-08-03 | 99.83.190.102 (ClassC) |
| 2026-01-06 | 75.2.70.75 (ClassC) |
| Date | Domain | IP |
| v2.tasking.ransomwarerewind.com | 2025-11-21 | 151.181.219.154 |
| v2-agent.tasking.ransomwarerewind.com | 2025-11-20 | 151.181.219.153 |
| auth.ransomwarerewind.com | 2024-12-27 | 99.84.66.121 |
| www.ransomwarerewind.com | 2024-08-23 | 52.42.122.102 |