Monitoring this pool, it appears that the actors are activating new domains, applying them for a couple of times, and then adding the domains to a pool of domains that are rotated across numerous IP infrastructure. Monitoring these clusters, we noticed an attempt to compromise a Western government entity in Ukraine on Jan. 19, 2022.