The IP was reported by users on Twitter as malicious

Cobalt Strike Server Found

C2: HTTPS @ 1[.]12[.]63[.]155:443

C2 Server: 121[.]194[.]7[.]196,/search/,121[.]194[.]7[.]197,/search/,121[.]194[...