Why not have a look at usual suspects' site
:-)
https://www.phoronix.com/scan.php?page=article&item=aws-graviton3-c7g&num=1
96 publicly visible posts • joined 22 Jun 2012
I believe they used obtained IP not as a proof of illegal activities , but to obtain a physical address of a suspect to raid his home and THEN try to gather evidence ( computer, pendrives , DVDs etc )