>forwarded the captured data to an address that does not appear anywhere on the public internet. The script’s source code refers to it as AutoMonitor.

I believe the address in question is https://analytics.infra.ndstudio.gov/metrics

as found in this snapshot https://web.archive.org/web/20260128044924/https://ndstudio....

other subdomains may be of interest: https://otx.alienvault.com/indicator/domain/ndstudio.gov?scr...

Related:

I found a second vote.gov – and it's registered to the White House

https://news.ycombinator.com/item?id=48298665

and on the Posthog tip:

Training our own AI models

https://news.ycombinator.com/item?id=48296359