A comment on the “Test 3” topic reminds me (duh) that tools other than the safe_vault log can be used to gather IP addresses of connecting machines. In the case of the comment it was client machines (launchers) but it should be possible to do that for vaults.
But today I have to catch up on work and leave this fun for a while.