Monitoring this pool, it seems that the actors are activating new domains, employing them for a few days, and then incorporating the domains to a pool of domains that are rotated across a variety of IP infrastructure. Monitoring these clusters, we observed an endeavor to compromise a Western govt entity in Ukraine on Jan. 19, 2022.