Been keeping an eye on this registrant registering DGA domains used for #socgholish payloads for a minute and noticed recently they were registering names outside of the usual random format.

These follow a pattern typical of their other next-stage payload servers where they redirect to Google if you navigate to the root dir:
getazurecommand[.]icu
azuregetrequest[.]icu
get-azurecommand[.]icu -> 67.217.228[.]186
azure-getrequest[.]icu -> 64[.]52.80.211

However these host a login page for an #hvnc service called #hvnc_blazor :
testmyws24[.]top -> 23.163.0[.]56
newrelayws24[.]top -> 5.161.234[.]18
testmyrelay[.]top
ws2424[.]top -> 168.100.11[.]52

#ioc #threatintel