Tycoon2FA Infrastructure IP Connections

Detects network traffic to IP addresses confirmed to host Tycoon2FA post-takedown components, including link management, credential harvesting, and kill switch infrastructure.