Even today, several days after publication of the report (which used a codename for the Russian attack, Grizzly Steppe), I’m still finding these suspicious IP addresses in my logs  although I would expect the Russians to stop using them after the U.S. government exposed them.