15 November 2023
Our investigation started when the Philippine media outlet MindaNews, the news arm of the Mindanao Institute of Journalism, made Qurium aware that they had found a clone of their website translated to Chinese. When looking into the case, we quickly realized that Minda News’ clone was just a small part of a large plot to clone hundreds of websites to drive readers to gambling websites.
The MindaNews team found a clone of their site in the domain m.mart-inn{.}com. The clone maintained the original design of the source but all content had been translated to Chinese.
When digging into the network prefix, we identified hundreds of cloned websites hosted in the very same network. The clones include websites from Universities, public libraries and private businesses.
The MindaNews’ clone is hosted in the network 50.2.35{.}0/24 operated by US based ServerHub (AS30693) owned by Eonix Corporation.
All clones were created during September 2021 and include advertisement of the gambling company “188bet” via the link to hxxp://www.520xingyun.com/from/188bet.php
A network of gambling companies and money laundry
On the www.520xingyun{.}com website we found a huge amount of gambling advertisements. Several of the websites promoted are connected to a physical address in the tax-heaven Isle of Man where several gambling companies are registered. The advertisements are connected to Cube Limited in the Isle of Man where 188BET is registered.
One of the websites promoted is linked to the company Kaiyun that according to their business license in the United Kingdom is operated by Gibraltrar-based TGP EUROPE LIMITED.
TGP Europe manages so called “white-label partnerships” for Chinese gambling companies. These Chinese gambling companies are often headquartered in nearby nations like Vietnam and the Philippines due the fact that gambling is banned in China.
The Gambling Commission in the United Kingdom has found TGP Europe Limited guilty of anti-money laundering (AML) and social responsibility failures between April 2020 and August 2022.
The use of “white-labels” to enter global markets is not new. Asian gambling companies are known to use intermediaries to get brand exposure in Asian markets where gambling advertising is banned.
According to Josimar, a media platform devoted solemnly to investigative football journalism, TGP Europe is providing its services to a majority of the (mostly) Chinese-controlled, Philippines-based gambling websites which have partnerships in place with Premier League club.
Registration of clone domains
The list of 250 domains used to promote gambling websites via the link hxxp://www.520xingyun.com/from/188bet.php seems to be organized in alphabetic order (IP addresses assigned to the domains increase in alphabetical order) that suggests that one single actor deployed the websites in different IP addresses inside ServerHub methodologically 🙂
The domains were registered during the 2021-07-08 and 2021-07-09 mostly using the domain registrar Gname.com Pte. Ltd. The choice of domain registrar does not seem casual as Gname is known to be involved in different WIPO (The World Intellectual Property Organization) cases of domains used for advertisements.
Gname is also connected to multiple cases where gambling companies register domains similar to other known brands to attract costumers. For example, the WIPO decision D2022-0722 or in this case from the Asian Domain Name Dispute Resolution Center show several references where Gname.com Pte. Ltd has been involved in similar “domain driving” practices.
The actors
Original sites (victims): Universities, public libraries and private business.
Cloned sites: 500+ clones hosted in the 50.2.35{.}0/24 and 50.3.118{.}0/24 networks inside hosting provider ServerHub (US).
Advertisement server: A server in IP address 27.255.64{.}19 acting as a landing place for the gambling advertisement to a wide range of players including 188bet, Kaiyun, BetVictor, Raybet, or Manbetx.
White label partner: Cube Limited and TGP Europe acting as intermediaries from Asian gambling businesses.
Asian gambling partners: 188bet, Kaiyun, BetVictor, Raybet, or Manbetx. 188bet has offices in Makati, Phillipines
Domain registrar: Gname.com Pte. Ltd. providing domain names to cloned sites.
Conclusion
Our investigation of the MindaNews’ clone website in Chinese has led us to discover hundreds of websites including dozens of academic institutions abused with the intention to drive traffic to gambling websites.
The gambling business hide behind white label companies that act as intermediaries, sush as Cube Limited and TGP Europe.
At the time of this writing the hosting provider ServerHub (US) has not taken any action against the client that has cloned hundreds of websites.
Appendix 1: The clones
50{.}2.35.2 baadar{.}com
50{.}2.35.2 chileexporta{.}com
50{.}2.35.2 tir-sportif{.}com
50{.}2.35.3 114chi{.}com
50{.}2.35.3 iwritefunny{.}com
50{.}2.35.3 plueckelmann{.}com
50{.}2.35.4 24-7autosurf{.}com
50{.}2.35.5 411daily{.}com
50{.}2.35.6 77domain{.}com
50{.}2.35.7 7-89{.}com
50{.}2.35.8 800-lending{.}com
50{.}2.35.9 944game{.}com
50{.}2.35.10 99acros{.}com
50{.}2.35.11 abiggernet{.}com
50{.}2.35.12 ademarmalaga{.}com
50{.}2.35.13 adultdepo{.}com
50{.}2.35.14 africonroof{.}com
50{.}2.35.15 ahb-sweden{.}com
50{.}2.35.16 asalacenter{.}com
50{.}2.35.17 asnamaldives{.}com
50{.}2.35.18 atelierjob{.}com
50{.}2.35.19 autorradios{.}com
50{.}2.35.20 petminderpro{.}com
50{.}2.35.20 selalumurah{.}com
50{.}2.35.21 baederblick{.}com
50{.}2.35.22 100k100days{.}com
50{.}2.35.22 barnsdallok{.}com
50{.}2.35.22 tjswimcamps{.}com
50{.}2.35.23 bbaltong{.}com
50{.}2.35.24 bdmusicbox{.}com
50{.}2.35.25 enronscandal{.}com
50{.}2.35.26 blogmylink{.}com
50{.}2.35.27 bspltd{.}com
50{.}2.35.28 btz-online{.}com
50{.}2.35.29 buyit2let{.}com
50{.}2.35.30 bynostar{.}com
50{.}2.35.31 cash-4u-now{.}com
50{.}2.35.32 cbambassador{.}com
50{.}2.35.33 cbsbev{.}com
50{.}2.35.34 ceharvey{.}com
50{.}2.35.35 celiamail{.}com
50{.}2.35.36 chadasnyder{.}com
50{.}2.35.37 chanelbuy{.}com
50{.}2.35.39 ciaorecord{.}com
50{.}2.35.40 cmfabogados{.}com
50{.}2.35.41 comryanair{.}com
50{.}2.35.42 cool-website{.}com
50{.}2.35.43 coralys-fr{.}com
50{.}2.35.44 correyforbes{.}com
50{.}2.35.45 cronusonline{.}com
50{.}2.35.46 curtbrinkman{.}com
50{.}2.35.47 d351gn5{.}com
50{.}2.35.48 daeseo{.}com
50{.}2.35.49 dalorto{.}com
50{.}2.35.50 dawnbeachsxm{.}com
50{.}2.35.52 dedetaylor{.}com
50{.}2.35.53 demerzone{.}com
50{.}2.35.54 dennynoto{.}com
50{.}2.35.55 dentalfuar{.}com
50{.}2.35.56 desearthers{.}com
50{.}2.35.57 design-swag{.}com
50{.}2.35.59 devinedevons{.}com
50{.}2.35.60 devsdistrict{.}com
50{.}2.35.61 dfreitas{.}com
50{.}2.35.62 dhdoulas{.}com
50{.}2.35.65 dressupdogs{.}com
50{.}2.35.66 drewsmale{.}com
50{.}2.35.67 drugmoneyart{.}com
50{.}2.35.68 duniapajak{.}com
50{.}2.35.69 durexart{.}com
50{.}2.35.70 easydatings{.}com
50{.}2.35.71 ebooks-4sale{.}com
50{.}2.35.72 efollete{.}com
50{.}2.35.73 elizabethmei{.}com
50{.}2.35.74 elladonna{.}com
50{.}2.35.76 escortskorea{.}com
50{.}2.35.77 eskymobile{.}com
50{.}2.35.78 etno-turizam{.}com
50{.}2.35.79 evilbitz{.}com
50{.}2.35.80 e-wood-mini{.}com
50{.}2.35.81 excelpump{.}com
50{.}2.35.82 expoland-dz{.}com
50{.}2.35.84 fibrosite{.}com
50{.}2.35.85 forex-way{.}com
50{.}2.35.86 fotozini{.}com
50{.}2.35.87 freetobid{.}com
50{.}2.35.88 furious-team{.}com
50{.}2.35.89 gaigoweb{.}com
50{.}2.35.90 gamesaholic{.}com
50{.}2.35.91 giantprick{.}com
50{.}2.35.92 gondalonline{.}com
50{.}2.35.93 gppssheet{.}com
50{.}2.35.94 hancheonju{.}com
50{.}2.35.95 hatersports{.}com
50{.}2.35.96 heboza{.}com
50{.}2.35.97 hedopphund{.}com
50{.}2.35.98 hellhath{.}com
50{.}2.35.99 herdrugby{.}com
50{.}2.35.101 house-lights{.}com
50{.}2.35.102 i402media{.}com
50{.}2.35.103 idjblast{.}com
50{.}2.35.105 i-lead-it{.}com
50{.}2.35.106 imafdi{.}com
50{.}2.35.107 image-mgt{.}com
50{.}2.35.109 ingassho{.}com
50{.}2.35.110 intercharts{.}com
50{.}2.35.111 itechdaily{.}com
50{.}2.35.113 janefishman{.}com
50{.}2.35.114 jimmypike{.}com
50{.}2.35.115 jlhphoto{.}com
50{.}2.35.116 jmf-group{.}com
50{.}2.35.117 jobs4world{.}com
50{.}2.35.118 jordanmade{.}com
50{.}2.35.119 joyofhorses{.}com
50{.}2.35.120 jtost{.}com
50{.}2.35.121 juliaweyland{.}com
50{.}2.35.122 julieanncohn{.}com
50{.}2.35.123 justinvirgo{.}com
50{.}2.35.124 kabudb{.}com
50{.}2.35.125 kampucha{.}com
50{.}2.35.126 kanntara{.}com
50{.}2.35.127 kepvideo{.}com
50{.}2.35.128 kerr-azy{.}com
50{.}2.35.129 kgu-ac{.}com
50{.}2.35.130 kibrisforum{.}com
50{.}2.35.131 kismetceyiz{.}com
50{.}2.35.132 knightlumber{.}com
50{.}2.35.133 koreaess{.}com
50{.}2.35.134 kovacstuzep{.}com
50{.}2.35.135 kqual{.}com
50{.}2.35.136 kylebastien{.}com
50{.}2.35.138 litebottle{.}com
50{.}2.35.139 loneassault{.}com
50{.}2.35.140 loucharmelle{.}com
50{.}2.35.141 macgator{.}com
50{.}2.35.142 magicpokemon{.}com
50{.}2.35.143 mahkotaindah{.}com
50{.}2.35.144 markknofler{.}com
50{.}2.35.145 mart-inn{.}com
50{.}2.35.146 massage-alix{.}com
50{.}2.35.147 maxenekleier{.}com
50{.}2.35.148 mazicbricks{.}com
50{.}2.35.149 mci-online{.}com
50{.}2.35.150 meremoggies{.}com
50{.}2.35.151 meuble-chic{.}com
50{.}2.35.152 miorit{.}com
50{.}2.35.153 mm-tools{.}com
50{.}2.35.154 mobilnick{.}com
50{.}2.35.155 moment-event{.}com
50{.}2.35.156 moovboots{.}com
50{.}2.35.157 mosaicmaiden{.}com
50{.}2.35.158 moulindugoth{.}com
50{.}2.35.159 mymentorlink{.}com
50{.}2.35.160 myoswell{.}com
50{.}2.35.161 mysupergenie{.}com
50{.}2.35.162 natweldsup{.}com
50{.}2.35.163 networx-corp{.}com
50{.}2.35.164 nmanley{.}com
50{.}2.35.165 nobleprizes{.}com
50{.}2.35.166 nod32korea{.}com
50{.}2.35.167 ntec-co{.}com
50{.}2.35.169 obnoxium{.}com
50{.}2.35.170 octalys{.}com
50{.}2.35.171 okescort{.}com
50{.}2.35.172 olscag{.}com
50{.}2.35.173 oshashop{.}com
50{.}2.35.175 pdxbeanies{.}com
50{.}2.35.176 peach-momo{.}com
50{.}2.35.177 peckboy{.}com
50{.}2.35.179 pibsystem{.}com
50{.}2.35.180 plasmales{.}com
50{.}2.35.184 preoped{.}com
50{.}2.35.185 prestijymm{.}com
50{.}2.35.186 pricecheckus{.}com
50{.}2.35.187 proglonet{.}com
50{.}2.35.188 ready4rental{.}com
50{.}2.35.190 reviewernews{.}com
50{.}2.35.191 reviews4biz{.}com
50{.}2.35.192 rigpoint2{.}com
50{.}2.35.193 rimanjeim{.}com
50{.}2.35.194 rkpib{.}com
50{.}2.35.195 rolfaulinger{.}com
50{.}2.35.196 roylounsbury{.}com
50{.}2.35.197 ruthmorales{.}com
50{.}2.35.198 sabbathabali{.}com
50{.}2.35.199 saiflowers{.}com
50{.}2.35.201 sdaphoto{.}com
50{.}2.35.202 sdwgames{.}com
50{.}2.35.204 shaqqa{.}com
50{.}2.35.205 sheenagupta{.}com
50{.}2.35.206 shoppingkite{.}com
50{.}2.35.207 shsuaxo{.}com
50{.}2.35.208 siriusstore{.}com
50{.}2.35.209 sitelistr{.}com
50{.}2.35.210 soil-ph{.}com
50{.}2.35.211 sscesa{.}com
50{.}2.35.212 ssdd-clan{.}com
50{.}2.35.213 steaktartar{.}com
50{.}2.35.214 stickeros{.}com
50{.}2.35.215 stigcorp{.}com
50{.}2.35.216 sur-rent{.}com
50{.}2.35.217 suzuki-swift{.}com
50{.}2.35.218 swimstamp{.}com
50{.}2.35.219 t2feathers{.}com
50{.}2.35.220 t2mlaw{.}com
50{.}2.35.221 testgyan{.}com
50{.}2.35.222 tgppl{.}com
50{.}2.35.223 thatsmyhorse{.}com
50{.}2.35.224 thegaslady{.}com
50{.}2.35.225 themagsmith{.}com
50{.}2.35.226 think1011{.}com
50{.}2.35.227 tiandiqigong{.}com
50{.}2.35.230 tomvprice{.}com
50{.}2.35.231 totalisators{.}com
50{.}2.35.232 trailcreekvt{.}com
50{.}2.35.234 turemak{.}com
50{.}2.35.235 twitterman{.}com
50{.}2.35.236 uhaonline{.}com
50{.}2.35.238 us-study{.}com
50{.}2.35.239 vcrossfit{.}com
50{.}2.35.240 vegas4us{.}com
50{.}2.35.241 wantashag{.}com
50{.}2.35.242 wdtsolutions{.}com
50{.}2.35.243 wearaboutart{.}com
50{.}2.35.244 webhostigpad{.}com
50{.}2.35.245 webpay411{.}com
50{.}2.35.246 wed-guide{.}com
50{.}2.35.248 windowsaudit{.}com
50{.}2.35.249 worldoftwist{.}com
50{.}2.35.250 worldtimeinc{.}com
50{.}2.35.251 xuezhucai{.}com
50{.}2.35.252 yodisoft{.}com
50{.}2.35.253 unicomcanada{.}com
50{.}2.35.253 your-medic{.}com
50{.}2.35.254 schmieso{.}com
50{.}2.35.254 zona-games{.}com
50{.}2.35.254 zooommm{.}com
50{.}3.118.2 doycar{.}com.
50{.}3.118.2 0828denden{.}com.
50{.}3.118.3 1985716{.}com.
50{.}3.118.3 bet-nba{.}com.
50{.}3.118.3 itsdiddy{.}com.
50{.}3.118.3 wwealerts{.}com.
50{.}3.118.3 pharma-plan{.}com.
50{.}3.118.4 1and1is2{.}com.
50{.}3.118.5 20minuteyoga{.}com.
50{.}3.118.6 212buy{.}com.
50{.}3.118.7 2marketers{.}com.
50{.}3.118.8 300kvaups{.}com.
50{.}3.118.9 311project{.}com.
50{.}3.118.10 369da{.}com.
50{.}3.118.11 410ent{.}com.
50{.}3.118.12 addisorder{.}com.
50{.}3.118.13 advancedpw{.}com.
50{.}3.118.14 ahmovies{.}com.
50{.}3.118.15 airlinkdoha{.}com.
50{.}3.118.16 ajonesphoto{.}com.
50{.}3.118.17 akinfefatou{.}com.
50{.}3.118.18 annhomes{.}com.
50{.}3.118.19 aptusmedical{.}com.
50{.}3.118.20 art-chess{.}com.
50{.}3.118.21 art-n-clay{.}com.
50{.}3.118.22 as197017{.}com.
50{.}3.118.23 asecretfire{.}com.
50{.}3.118.24 aussiepasses{.}com.
50{.}3.118.25 autresphere{.}com.
50{.}3.118.26 baicila{.}com.
50{.}3.118.27 banditsband{.}com.
50{.}3.118.28 bankbtpn{.}com.
50{.}3.118.29 bb-laflora{.}com.
50{.}3.118.30 doycar{.}com.
50{.}3.118.30 beaudefy{.}com.
50{.}3.118.30 efendicafe{.}com.
50{.}3.118.31 beaujewels{.}com.
50{.}3.118.32 bemoduk{.}com.
50{.}3.118.33 benedicti{.}com.
50{.}3.118.34 bet-nba{.}com.
50{.}3.118.35 bnpnews24{.}com.
50{.}3.118.36 boatm8{.}com.
50{.}3.118.37 bobbrothers{.}com.
50{.}3.118.38 botasespana{.}com.
50{.}3.118.39 budvahoteli{.}com.
50{.}3.118.40 cartsnwheels{.}com.
50{.}3.118.41 channelac{.}com.
50{.}3.118.42 cintaputih{.}com.
50{.}3.118.43 click-host{.}com.
50{.}3.118.44 cneaful{.}com.
50{.}3.118.45 cofficup{.}com.
50{.}3.118.46 compadukweb{.}com.
50{.}3.118.47 crafty-craft{.}com.
50{.}3.118.48 crimeawalks{.}com.
50{.}3.118.49 crorally{.}com.
50{.}3.118.50 csr-dc{.}com.
50{.}3.118.51 dgtcc{.}com.
50{.}3.118.52 dhljerseys{.}com.
50{.}3.118.53 discountcook{.}com.
50{.}3.118.54 divorcehit{.}com.
50{.}3.118.55 djg-string{.}com.
50{.}3.118.56 doapagi{.}com.
50{.}3.118.57 doraflowers{.}com.
50{.}3.118.58 doycar{.}com.
50{.}3.118.59 dradsdeals{.}com.
50{.}3.118.60 dreprince{.}com.
50{.}3.118.61 e-car-go{.}com.
50{.}3.118.62 ecmna114{.}com.
50{.}3.118.63 eco-sunshine{.}com.
50{.}3.118.64 efendicafe{.}com.
50{.}3.118.65 elcarm{.}com.
50{.}3.118.66 eljareeda{.}com.
50{.}3.118.67 emineakbucak{.}com.
50{.}3.118.68 emrspace{.}com.
50{.}3.118.69 encodon{.}com.
50{.}3.118.70 etoobe{.}com.
50{.}3.118.71 eutreatment{.}com.
50{.}3.118.72 expediorpm{.}com.
50{.}3.118.73 faturayatir{.}com.
50{.}3.118.74 fddmanager{.}com.
50{.}3.118.75 feetulcer{.}com.
50{.}3.118.76 fflbeauty{.}com.
50{.}3.118.77 fikirgrubu{.}com.
50{.}3.118.78 filet-elec{.}com.
50{.}3.118.79 flat-washer{.}com.
50{.}3.118.80 flo-n{.}com.
50{.}3.118.81 flrps{.}com.
50{.}3.118.82 folkartmom{.}com.
50{.}3.118.83 forexclue{.}com.
50{.}3.118.84 fuc{.}company.com.
50{.}3.118.85 funforsure{.}com.
50{.}3.118.86 g-goddess{.}com.
50{.}3.118.87 giftsix{.}com.
50{.}3.118.88 gingerarcher{.}com.
50{.}3.118.89 globalelove{.}com.
50{.}3.118.90 glocose{.}com.
50{.}3.118.91 gm-traders{.}com.
50{.}3.118.92 gormonsrosta{.}com.
50{.}3.118.93 grimfetch{.}com.
50{.}3.118.94 guaguababy{.}com.
50{.}3.118.95 gunsameica{.}com.
50{.}3.118.96 gvlhorse{.}com.
50{.}3.118.97 gvlrx{.}com.
50{.}3.118.98 hamasusan{.}com.
50{.}3.118.99 hanifhalim{.}com.
50{.}3.118.100 hawaiigurume{.}com.
50{.}3.118.101 hkyoyo{.}com.
50{.}3.118.102 hmm-hmmm{.}com.
50{.}3.118.103 hmrsystems{.}com.
50{.}3.118.104 housedigg{.}com.
50{.}3.118.105 houseofhawgs{.}com.
50{.}3.118.106 humdeedum{.}com.
50{.}3.118.107 ie-me{.}com.
50{.}3.118.108 indiqueganhe{.}com.
50{.}3.118.109 ipetek{.}com.
50{.}3.118.110 iran-store{.}com.
50{.}3.118.111 itsdiddy{.}com.
50{.}3.118.112 jasawebkita{.}com.
50{.}3.118.113 jayfray{.}com.
50{.}3.118.114 jaynelloyd{.}com.
50{.}3.118.115 jeffpikus{.}com.
50{.}3.118.116 jezjackson{.}com.
50{.}3.118.117 jikohassan{.}com.
50{.}3.118.118 jimsocks{.}com.
50{.}3.118.119 joaskin{.}com.
50{.}3.118.120 joeknuckles{.}com.
50{.}3.118.121 johnmartes{.}com.
50{.}3.118.122 jsmmps{.}com.
50{.}3.118.123 julia-paul{.}com.
50{.}3.118.124 justmejessie{.}com.
50{.}3.118.125 justmorkies{.}com.
50{.}3.118.126 kcwhitney{.}com.
50{.}3.118.127 kirikcitarim{.}com.
50{.}3.118.128 knowledge411{.}com.
50{.}3.118.129 kocleaner{.}com.
50{.}3.118.130 kosherfeet{.}com.
50{.}3.118.131 kosunji{.}com.
50{.}3.118.132 kuotashop{.}com.
50{.}3.118.133 lascabanitas{.}com.
50{.}3.118.134 lb148{.}com.
50{.}3.118.135 lb-hr{.}com.
50{.}3.118.136 le-haim{.}com.
50{.}3.118.137 lemestric{.}com.
50{.}3.118.138 licblog{.}com.
50{.}3.118.139 light-4u{.}com.
50{.}3.118.140 litgriot{.}com.
50{.}3.118.141 log27{.}com.
50{.}3.118.142 luarosa{.}com.
50{.}3.118.143 lucas-help{.}com.
50{.}3.118.144 lukedreyer{.}com.
50{.}3.118.145 mailramp{.}com.
50{.}3.118.146 maladlist{.}com.
50{.}3.118.147 melandillc{.}com.
50{.}3.118.148 merkalis{.}com.
50{.}3.118.149 miaindiana{.}com.
50{.}3.118.150 miaplace{.}com.
50{.}3.118.151 minsche{.}com.
50{.}3.118.152 misslija{.}com.
50{.}3.118.153 mitzpeshalem{.}com.
50{.}3.118.154 m-k-design{.}com.
50{.}3.118.155 modailsalon{.}com.
50{.}3.118.156 mreservice{.}com.
50{.}3.118.157 msgicjack{.}com.
50{.}3.118.158 multbanners{.}com.
50{.}3.118.159 mynewhomemls{.}com.
50{.}3.118.160 my-pmu{.}com.
50{.}3.118.161 mystandmixer{.}com.
50{.}3.118.162 mywiredcafe{.}com.
50{.}3.118.163 nakedfreaks{.}com.
50{.}3.118.164 nanumcinema{.}com.
50{.}3.118.165 narvausa{.}com.
50{.}3.118.166 neilandrew{.}com.
50{.}3.118.167 ninudesign{.}com.
50{.}3.118.168 nopilrow{.}com.
50{.}3.118.169 nucleoware{.}com.
50{.}3.118.170 oakorigin{.}com.
50{.}3.118.171 obankrotim{.}com.
50{.}3.118.172 offbeatcook{.}com.
50{.}3.118.173 osca-jp{.}com.
50{.}3.118.174 ottomotal{.}com.
50{.}3.118.175 ozdalcuval{.}com.
50{.}3.118.176 parkandroid{.}com.
50{.}3.118.177 patelgroups{.}com.
50{.}3.118.178 pcwmobile{.}com.
50{.}3.118.179 pearsonchool{.}com.
50{.}3.118.180 pefata{.}com.
50{.}3.118.181 peseonline{.}com.
50{.}3.118.182 pharma-plan{.}com.
50{.}3.118.183 pigsontour{.}com.
50{.}3.118.184 p-p-f{.}com.
50{.}3.118.185 ps1988{.}com.
50{.}3.118.186 psicolabor{.}com.
50{.}3.118.187 pumanvillage{.}com.
50{.}3.118.188 quangloc{.}com.
50{.}3.118.189 quick-r{.}com.
50{.}3.118.190 quixoticroad{.}com.
50{.}3.118.191 rayanvaish{.}com.
50{.}3.118.192 resury{.}com.
50{.}3.118.193 ricardux{.}com.
50{.}3.118.194 ridersflight{.}com.
50{.}3.118.195 rigspy{.}com.
50{.}3.118.196 ringuru{.}com.
50{.}3.118.197 rogersfh{.}com.
50{.}3.118.198 roxyclothing{.}com.
50{.}3.118.199 ryanshockey{.}com.
50{.}3.118.200 rzhenli{.}com.
50{.}3.118.201 sabayastore{.}com.
50{.}3.118.202 sabeder{.}com.
50{.}3.118.203 samhallman{.}com.
50{.}3.118.204 sandyandsons{.}com.
50{.}3.118.205 sareej{.}com.
50{.}3.118.206 sarugamall{.}com.
50{.}3.118.207 scottrede{.}com.
50{.}3.118.208 script-one{.}com.
50{.}3.118.209 segerfrojd{.}com.
50{.}3.118.210 sharon-case{.}com.
50{.}3.118.211 shazslimo{.}com.
50{.}3.118.212 sherriegray{.}com.
50{.}3.118.213 shopatonce{.}com.
50{.}3.118.214 shorteddy{.}com.
50{.}3.118.215 shpantz{.}com.
50{.}3.118.216 silva2{.}com.
50{.}3.118.217 simplesudz{.}com.
50{.}3.118.218 sitoys{.}com.
50{.}3.118.219 smartzoneth{.}com.
50{.}3.118.220 spicediver{.}com.
50{.}3.118.221 srcesq{.}com.
50{.}3.118.222 statestpizza{.}com.
50{.}3.118.223 straybay{.}com.
50{.}3.118.224 superkickz{.}com.
50{.}3.118.225 s-wall{.}com.
50{.}3.118.226 sweetkolkata{.}com.
50{.}3.118.227 tanaka-law{.}com.
50{.}3.118.228 teammarx{.}com.
50{.}3.118.229 testforjobs{.}com.
50{.}3.118.230 theabqteam{.}com.
50{.}3.118.231 theotechs{.}com.
50{.}3.118.232 thestudio-z{.}com.
50{.}3.118.233 tmetaco{.}com.
50{.}3.118.234 too-sweet{.}com.
50{.}3.118.235 tranasocab{.}com.
50{.}3.118.236 traptrakz{.}com.
50{.}3.118.237 troysoc{.}com.
50{.}3.118.238 tvcayman{.}com.
50{.}3.118.239 uaenetball{.}com.
50{.}3.118.240 udkresources{.}com.
50{.}3.118.241 updates-info{.}com.
50{.}3.118.242 ustwinks{.}com.
50{.}3.118.243 vadeviajes{.}com.
50{.}3.118.244 vedicsage{.}com.
50{.}3.118.245 vennerfilm{.}com.
50{.}3.118.246 virustara{.}com.
50{.}3.118.247 vitsmart{.}com.
50{.}3.118.248 voudr{.}com.
50{.}3.118.249 webnivore{.}com.
50{.}3.118.250 wnumbers{.}com.
50{.}3.118.251 wwealerts{.}com.
50{.}3.118.252 zerotime-eg{.}com.
50{.}3.118.253 zhuyintao{.}com.
50{.}3.118.254 zogirls{.}com.
Universities targeted
7-89{.}com ## University of Alabama
africonroof{.}com ## Home | Alabama State University
buyit2let{.}com ## Dominican University
curtbrinkman{.}com ## Columbia University Irving Medical Center
dalorto{.}com ## Shenandoah University - Open and In Person
drewsmale{.}com ## University of Oklahoma Libraries
hancheonju{.}com ## Trinity Saint David University of Wales
okescort{.}com ## The Geography of Transport Systems
pdxbeanies{.}com ## Oklahoma State University Libraries
preoped{.}com ## University of Nebraska - Lincoln University
shoppingkite{.}com ## Teaching Center | Vanderbilt University
sur-rent{.}com ## Cape Breton University: Cape Breton University
turemak{.}com ## Oregon State University
wearaboutart{.}com ## University of Georgia - University of Georgia Museum of Art
worldoftwist{.}com ## Medical School: Florida Atlantic University - Charles E. Schmidt College of Medicine
News outlets targeted
100k100days{.}com ## Christianacare News
114chi{.}com ## JHU News
77domain{.}com ## Pharmaceutical Industry News
btz-online{.}com ## F1 News, Live Race Coverage
dedetaylor{.}com ## Health: Fitness, Nutrition, Tools, News, Wellness Magazine
dentalfuar{.}com ## Motorcycle News, Motorcycle Reviews
knightlumber{.}com ## Indiana Daily Student Newspaper
mart-inn{.}com ## Mindanao News
ready4rental{.}com ## Car News, Car Reviews and Car Technology
t2feathers{.}com ## Technical Textiles and Smart Textiles News
zona-games{.}com ## Canadian Metalworking