Threat intel researcher focused on infrastructure hunting. Views are my own and not my employer's.https://bsky.app/profile/kyleehmke.bsky.socialhttps://bsky.app/profile/kyleehmke.bsky.social/post/3mpgoghrdok2kSuspicious domain ms365update[.]com was registered through MonoVM on 6/22/26 using juliarhorton@onionmail[.]org (H/t @domaintools.bsky.social). Today the domain began using Cloudflare and its subdomain www.ms365update[.]com now redirects to Google DNS.29 Jun 2026 14:15 +0000at://did:plc:akra5unvbg7ytr5prrulpwwt/app.bsky.feed.post/3mpgoghrdok2khttps://bsky.app/profile/kyleehmke.bsky.social/post/3mgxd2qxwg22vThe dark money group’s democracyunmuted[.]org domain is almost certainly administered using the same Cloudflare account as demfluencers[.]com. The latter—originally registered in June 2025 and operational in the Nov/Dec timeframe—claims to provide paid opportunities and access for influencers. [contains quote post or other embedded content]13 Mar 2026 16:21 +0000at://did:plc:akra5unvbg7ytr5prrulpwwt/app.bsky.feed.post/3mgxd2qxwg22vhttps://bsky.app/profile/kyleehmke.bsky.social/post/3me4qoteiqk2pBetween 10 and 11 September 2025, the “Know your voting rights” entry for college students was removed from vote.gov. While not definitively related, this coincides with the timeframe—8 September 2025 per the earliest cert—when National Design Studio ostensibly began working on the site.05 Feb 2026 15:52 +0000at://did:plc:akra5unvbg7ytr5prrulpwwt/app.bsky.feed.post/3me4qoteiqk2phttps://bsky.app/profile/kyleehmke.bsky.social/post/3md6wsvmxhk2aNew toadie site in the works: 47compliance[.]org Highly likely administered using the same Cloudflare account as a number of other pro Trump/GOP and anti Dem sites, including: insidebidensbasement[.]org kamalaskoup[.]org protect47[.]org24 Jan 2026 19:22 +0000at://did:plc:akra5unvbg7ytr5prrulpwwt/app.bsky.feed.post/3md6wsvmxhk2ahttps://bsky.app/profile/kyleehmke.bsky.social/post/3mczce6dlbs2pNew Children's Health Defense site registered on 1/9/26 and currently in development: covidjustice[.]org covidjustice[.]metalteam[.]dev (69.16.249[.]248, dev site)22 Jan 2026 13:32 +0000at://did:plc:akra5unvbg7ytr5prrulpwwt/app.bsky.feed.post/3mczce6dlbs2phttps://bsky.app/profile/kyleehmke.bsky.social/post/3m3ap6qgcdk2tSuspicious domain ms-driversync[.]com was registered through Njalla on 10/14/25 and resolves to 192.166.82[.]94.15 Oct 2025 16:49 +0000at://did:plc:akra5unvbg7ytr5prrulpwwt/app.bsky.feed.post/3m3ap6qgcdk2thttps://bsky.app/profile/kyleehmke.bsky.social/post/3m3ap3ed3ys2tSuspicious domain mfa[.]directory was registered through Njalla on 10/15/25 and resolves to 149.33.2[.]67.15 Oct 2025 16:47 +0000at://did:plc:akra5unvbg7ytr5prrulpwwt/app.bsky.feed.post/3m3ap3ed3ys2thttps://bsky.app/profile/kyleehmke.bsky.social/post/3lxi3g47m6k2jBest conference in the industry is back! cyberwarcon.com [contains quote post or other embedded content]28 Aug 2025 17:36 +0000at://did:plc:akra5unvbg7ytr5prrulpwwt/app.bsky.feed.post/3lxi3g47m6k2jhttps://bsky.app/profile/kyleehmke.bsky.social/post/3lwedvs2udc2uSuspicious domains micrsosft-netupdate[.]net (109.107.172[.]123) and micrsosft-netupdate[.]net (146.103.115[.]183) were co-registered through Njalla on 8/14/25.14 Aug 2025 12:32 +0000at://did:plc:akra5unvbg7ytr5prrulpwwt/app.bsky.feed.post/3lwedvs2udc2uhttps://bsky.app/profile/kyleehmke.bsky.social/post/3lvqfu7d34c2vSuspicious domain adobereader[.]cc was registered through MonoVM on 8/5/25 using freewanatoly@2mail[.]co. Currently resolves to M247 IP 84.252.95[.]40.06 Aug 2025 14:14 +0000at://did:plc:akra5unvbg7ytr5prrulpwwt/app.bsky.feed.post/3lvqfu7d34c2vhttps://bsky.app/profile/kyleehmke.bsky.social/post/3lu3urxrzas2oSuspicious domain sophossec[.]com was registered through MonoVM on 7/15/25 using kehmar.maung@proton[.]me and resolves to 146.70.247[.]55.16 Jul 2025 16:50 +0000at://did:plc:akra5unvbg7ytr5prrulpwwt/app.bsky.feed.post/3lu3urxrzas2ohttps://bsky.app/profile/kyleehmke.bsky.social/post/3ls2mhgncik2ySuspicious domains awsonlineserch[.]com and azuronlineserch[.]com were co-registered through Njalla on 6/19/25. Currently resolving to 34.204.12[.]191 and 20.83.167[.]25, respectively.20 Jun 2025 17:58 +0000at://did:plc:akra5unvbg7ytr5prrulpwwt/app.bsky.feed.post/3ls2mhgncik2yhttps://bsky.app/profile/kyleehmke.bsky.social/post/3lptpoioc7k25Suspicious domain windowsntp[.]com was registered through Njalla on 5/22/25 and then began using Cloudflare. Domain itself does not resolve, but subdomain www.windowsntp[.]com indicates MSFT Azure use.23 May 2025 13:16 +0000at://did:plc:akra5unvbg7ytr5prrulpwwt/app.bsky.feed.post/3lptpoioc7k25https://bsky.app/profile/kyleehmke.bsky.social/post/3lpjosiltuk2nSuspicious domain m365sessionlogin[.]com was registered through Njalla on 5/18/25. Domain itself does not resolve, but subdomains login, logon, and office365 indicate hosting at 80.78.30[.]154.19 May 2025 13:34 +0000at://did:plc:akra5unvbg7ytr5prrulpwwt/app.bsky.feed.post/3lpjosiltuk2nhttps://bsky.app/profile/kyleehmke.bsky.social/post/3lpc37owmlc2sHighly likely Parscale / Nucleus-administered domain congressstrongaction[.]org was registered on 9/23/24 and recently began hosting content. The org's stated policy positions appear largely aimed at curtailing laws and protections related to natural resources.16 May 2025 12:55 +0000at://did:plc:akra5unvbg7ytr5prrulpwwt/app.bsky.feed.post/3lpc37owmlc2shttps://bsky.app/profile/kyleehmke.bsky.social/post/3lnl45onzhk2xSet of suspicious domains co-registered through Njalla on 4/24/25: esxiupdate[.]com threatbook[.]cloud Not currently resolving, but worth keeping an eye on.24 Apr 2025 16:15 +0000at://did:plc:akra5unvbg7ytr5prrulpwwt/app.bsky.feed.post/3lnl45onzhk2xhttps://bsky.app/profile/kyleehmke.bsky.social/post/3llw3khizzs2sSet of suspicious domains registered on 4/2/25 (unclear through which reseller) and administered using the same Cloudflare account: googlealert[.]net microsoft365signin[.]net microsoftalert[.]net outlooksecurity[.]net outlooksignin[.]net03 Apr 2025 14:13 +0000at://did:plc:akra5unvbg7ytr5prrulpwwt/app.bsky.feed.post/3llw3khizzs2shttps://bsky.app/profile/kyleehmke.bsky.social/post/3lltk2wr7rc2jSuspicious domain analytics[.]airforce was registered through Njalla on 4/2/25 and resolves to BL Networks IP 64.52.80[.]61.02 Apr 2025 13:55 +0000at://did:plc:akra5unvbg7ytr5prrulpwwt/app.bsky.feed.post/3lltk2wr7rc2jhttps://bsky.app/profile/kyleehmke.bsky.social/post/3lku5zgfqjk2fThe Children's Health Defense staging site associated with realcdc[.]org indicates they are setting it up to pose as a legitmate CDC site questioning vaccine safety, complete with parent testimonials. Currently no overt indication the site is run by CHD. [contains quote post or other embedded content]21 Mar 2025 02:27 +0000at://did:plc:akra5unvbg7ytr5prrulpwwt/app.bsky.feed.post/3lku5zgfqjk2fhttps://bsky.app/profile/kyleehmke.bsky.social/post/3lk42ez56js2nSuspicious domain chromeupdate[.]net was registered through Njalla on 3/11/25. Not currently resolving, but worth keeping an eye on.11 Mar 2025 12:18 +0000at://did:plc:akra5unvbg7ytr5prrulpwwt/app.bsky.feed.post/3lk42ez56js2nhttps://bsky.app/profile/kyleehmke.bsky.social/post/3lk42d556422nSuspicious domain nvidia-installer[.]com was registered through Njalla on 3/10/25 and resolves to 51.44.166[.]225.11 Mar 2025 12:17 +0000at://did:plc:akra5unvbg7ytr5prrulpwwt/app.bsky.feed.post/3lk42d556422nhttps://bsky.app/profile/kyleehmke.bsky.social/post/3ljpttsfvl22qTwo suspicious domains co-registered through Njalla on 3/6/25: sfsimpact[.]org and dogechronicle[.]com. The former purports to be an independent analysis claiming inefficiency in the NSF CyberCorps Scholarship for Service (SFS); the latter claims to report on DOGE activity. (1/4)06 Mar 2025 15:49 +0000at://did:plc:akra5unvbg7ytr5prrulpwwt/app.bsky.feed.post/3ljpttsfvl22qhttps://bsky.app/profile/kyleehmke.bsky.social/post/3lip4fz6wo22dSuspicious domain downloadfile-dropbox[.]com was registered through Njalla on 2/21/25 and is hosted at 86.54.42[.]36.21 Feb 2025 15:24 +0000at://did:plc:akra5unvbg7ytr5prrulpwwt/app.bsky.feed.post/3lip4fz6wo22dhttps://bsky.app/profile/kyleehmke.bsky.social/post/3limhmja4y22aSuspicious domain onelivedrv[.]com was registered through Njalla on 2/20/25 and is hosted at 193.42.39[.]159.20 Feb 2025 14:07 +0000at://did:plc:akra5unvbg7ytr5prrulpwwt/app.bsky.feed.post/3limhmja4y22ahttps://bsky.app/profile/kyleehmke.bsky.social/post/3lihdbnhltc2aSuspicious domain vmware-analytics[.]com was registered through Njalla on 2/17/24. Not currently resolving, but subdomain app.vmware-analytics[.]com shows resolution to 178.131.20[.]47.18 Feb 2025 13:06 +0000at://did:plc:akra5unvbg7ytr5prrulpwwt/app.bsky.feed.post/3lihdbnhltc2a