The following is a set of domains known and managed and operated by Sp3cial1st from Darkode.

Email address accounts known to have been involved in the campaign include:

[email protected]

[email protected]

[email protected]

Sample MD5s known to have been communicating with one of the domains include:

adcbf2ea5a9709b455fd2baf002b81ef

1aa2388ec405059bc27b177001c3b096

Sample domain portfolio includes:

hxxp://bluewavebookings.com

hxxp://ansonfamily.us

hxxp://successfullfreedom.us

hxxp://aquaworldmarine.com

hxxp://buycomplete1.com

hxxp://gqali.com

hxxp://clementmunns.com

hxxp://corp-gems.com

hxxp://be-liberty.com

hxxp://obey.su

hxxp://feltoninteractive.com

hxxp://skyrocketadv.com

hxxp://e-commt.net

hxxp://catalystechnologies.com

hxxp://bpoval.com

hxxp://darkness.su

hxxp://tananashvili.com

hxxp://axcelsp.com

hxxp://clickforsupport.us

hxxp://crunchycrew.com

hxxp://enuniq.com

hxxp://gotots.us

hxxp://bestmailonline.com

hxxp://germandise.com

hxxp://gldt.net

hxxp://sethyoufree.tv

hxxp://jy-partners.com

hxxp://iohex.com

hxxp://brit.tw