ProtonVPN IP Used in Initial Reconnaissance for Gitea Exploit

An IP address from ProtonVPN service (159.26.98[.]241) was observed in the initial reconnaissance phase of the attempted exploitation of CVE-2026-20896, though no actual exploitation occurred.