So the location of the server used to generate phishing emails counts as evidence of its origin? Were there IOCs that link non-circumstantially to a state spons

So the location of the server used to generate phishing emails counts as evidence of its origin? Were there IOCs that link non-circumstantially to a state sponsored effort?