>forwarded the captured data to an address that does not appear anywhere on the public internet. The script’s source code refers to it as AutoMonitor.

I believe the address in question is https://analytics.infra.ndstudio.gov/metrics

as found in this snapshot https://web.archive.org/web/20260128044924/https://ndstudio....

other subdomains may be of interest: https://otx.alienvault.com/indicator/domain/ndstudio.gov?scr...