In the context of threat actor attribution, which of the following is a method used to track the command and control server?

{} [+]