one of the key domains in the spearphishing campaign of 2015-16, to which DNC and Podesta hacks attributed, was still in operation in late May 2018 - hosted, surprisingly, in New York City right under Mueller's nose. See climateaudit.org/2018/07/19/a-r…
2/ the spearphishing domain (googlesetting[.]com) was reported in June 2016 in SecureWorks's original description of bitly-using spearphishing campaign:
: secureworks.com/research/threa… showing hyperlink illustrated below. ZGlm...string is target address in base64
: secureworks.com/research/threa… showing hyperlink illustrated below. ZGlm...string is target address in base64
3/ earliest attested spearphish email using this domain (and base64 encoding) was on July 23, 2014 using syntax illustrated below.
4/ on May 25, 2018, there was a spearphishing email with IDENTICAL syntax illustrated below. In May 2018, the domain resolved to an IP address in New York City. see: climateaudit.org/2018/07/19/a-r…
