Figure 6: The GMail account of an individual infected by the same attacker was accessed from an IP address that hosted a computer called “INSA-PC.” Google incorrectly geolocates the address in France.