I bet they are running Google and Meta ads to generate traffic to these malicious domains.
You should read the article and see!
You should read the article and see!