Colt had ecrime IP addresses talking to a bunch of SharePoint servers (now offline), which also appeared to have webshells on them.