Those DO seem to be some of the systems rumored to be involved. However, based on the screenshot, and a NetCraft analysis, it appears those addresses are (or were) hosted in an Amazon Web Services (AWS) “cloud” - meaning that they were likely virtual servers, and not hosted on a single or definitive piece of hardware that could be physically confiscated or secured.
https://sitereport.netcraft.com/?url=http://ots.scytl.com
This is just an ad hoc non-professional summary analysis, of course, but that is what it shows.
ThankQ.