Nymaim IoCs 10/19/18

Nymaim IoCs

It looks like there is a re-director at the top of all of these domains that will do two things:
1. Give you the zip file if this is the first time you have visited.
2. Send you to Yandex.com or respond with an 8 byte page of "Fuck Off" if you have already visited once before.

Here are the domains:

2019bracket.com
2069brackets.com
activenavy.com
adomesticworld.com
allpurplehandling.com
anilmoni.com
answermanagementgroup.com
antinomics.com
bluestarpaymentsolutions.com
boobfanclub.com
borderlands3.com
brickell100.com
bubsware.com
cactopelli.com
careercoachingbusiness.com
carinsurancedirectories.com
cashcentralau.com - may be down
cclawsuit.com
cgunited.com
crosspeenpress.com
crystalhotel.com
dmknott.com
docswitch.com
ecigarettestudies.com
expertsjourney.com
farminginthefloodplain.com
galtdentalcambridge.com
geziyurdu.com
gloria-glowfish.com
gnosmij.com
gokceozagar.com
greatwp.com
ieltsonlinetest.com
indiangirlsnude.com
indicasativas.com
inmotionframework.com
internationalboardingandpetservicesassociation.com
intimateimagery.com
iptechnologysolutions.com
iscanhome.com

The random characters for the directories arbitrary and dont seem to matter. Requests to the root of the domain will redirect you to the zip download. Nevertheless, here is what I noticed for the formatting of the URLs included in the emails. Most of this came from @ps66uk's work or advice on how to find them. :)

http://2019bracket.com/bzysisyh
http://2069brackets.com/
http://2069brackets.com/afhibfsf
http://2069brackets.com/hbbirade
http://2069brackets.com/iffdsdnr
http://activenavy.com/heazsyit
http://activenavy.com/hhisseeh
http://activenavy.com/nreetrtz
http://activenavy.com/reyzidbz
http://adomesticworld.com/aryintba
http://adomesticworld.com/bdysnrbr
http://adomesticworld.com/bssdfrtn
http://adomesticworld.com/tkebzdsn
http://allpurplehandling.com/aazerybz
http://allpurplehandling.com/erksdfky
http://allpurplehandling.com/ezfeaake
http://allpurplehandling.com/fsaadzdf
http://allpurplehandling.com/rhryyabi
http://anilmoni.com/azbsfynd
http://anilmoni.com/ibzkzfdd
http://anilmoni.com/rierizsn
http://anilmoni.com/zkzsfekf
http://answermanagementgroup.com/hzfaaiaz
http://antinomics.com/byyzhhns
http://antinomics.com/ddrsinsy
http://antinomics.com/ehyhysae
http://antinomics.com/fdiertft
http://antinomics.com/iyzkthsf
http://antinomics.com/zkddtsid
http://bluestarpaymentsolutions.com/dhyeehns
http://bluestarpaymentsolutions.com/htbkztef
http://bluestarpaymentsolutions.com/hydeydzd
http://boobfanclub.com/deesadfk
http://boobfanclub.com/ynzbifdh
http://borderlands3.com/akrbfaay
http://borderlands3.com/atbfthks
http://borderlands3.com/bnhbnsne
http://borderlands3.com/dadtesnk
http://borderlands3.com/ffneihbk
http://borderlands3.com/hntabhez
http://borderlands3.com/itnyeshz
http://brickell100.com/eidtkfhe
http://brickell100.com/fntdiate
http://brickell100.com/iyetfthd
http://brickell100.com/neizbeay
http://brickell100.com/szdeaaie
http://brickell100.com/zsifahns
http://bubsware.com/dybtkfdt
http://bubsware.com/ffeabnfy
http://bubsware.com/yeekzzsa
http://bubsware.com/znnrszed
http://cactopelli.com/ddzhzzfa
http://cactopelli.com/ehddezft
http://cactopelli.com/hzahdbkd
http://cactopelli.com/issditnk
http://cactopelli.com/kazbtkbs
http://cactopelli.com/kznzsbks
http://cactopelli.com/rrredskb
http://careercoachingbusiness.com/adrrerfn
http://careercoachingbusiness.com/hhdyanzk
http://careercoachingbusiness.com/ndinirdb
http://careercoachingbusiness.com/rfnhyhrd
http://careercoachingbusiness.com/sbhkdhit
http://careercoachingbusiness.com/zrbinzrk
http://carinsurancedirectories.com/rtzysair
http://cashcentralau.com/dnkzzztt
http://cclawsuit.com/ehikbddy
http://cclawsuit.com/hiznbyrz
http://cclawsuit.com/hseifkti
http://cclawsuit.com/itnisaeb
http://cclawsuit.com/nidtfdei
http://cclawsuit.com/zishsten
http://cclawsuit.com/zznkyihf
http://cgunited.com/btzkrzkn
http://cgunited.com/fabfddhz
http://cgunited.com/trfbsdft
http://crosspeenpress.com/aadfsiia
http://crosspeenpress.com/eddhrzyn
http://crosspeenpress.com/eeaykkzk
http://crystalhotel.com/fkhaiazf
http://crystalhotel.com/ndzahsnt
http://crystalhotel.com/nzbnnyia
http://crystalhotel.com/rdzyhrtb
http://dmknott.com/aieekrfy
http://dmknott.com/bebiarar
http://dmknott.com/bfdbddnt
http://dmknott.com/bnnzbkik
http://dmknott.com/dnkbradz
http://dmknott.com/etedeise
http://dmknott.com/hkithdfz
http://dmknott.com/iznahder
http://dmknott.com/kfknyzbh
http://dmknott.com/nyhyazkk
http://dmknott.com/tefrnade
http://docswitch.com/andrtyab
http://docswitch.com/bkeridkk
http://docswitch.com/rfyfnzsb
http://docswitch.com/tnndyefa
http://docswitch.com/znitnhdi
http://ecigarettestudies.com/beirrnar
http://expertsjourney.com/bhfrndii
http://expertsjourney.com/esriinra
http://expertsjourney.com/hsyfhzyb
http://expertsjourney.com/narnbthf
http://farminginthefloodplain.com/dfinetyk
http://farminginthefloodplain.com/diktarkf
http://farminginthefloodplain.com/dtsirnat
http://farminginthefloodplain.com/iaefdzah
http://farminginthefloodplain.com/inreaydt
http://farminginthefloodplain.com/itbzeber
http://farminginthefloodplain.com/yeyerdth
http://farminginthefloodplain.com/ytzktskb
http://galtdentalcambridge.com/nyizdhst
http://geziyurdu.com/skfnnfkd
http://gloria-glowfish.com/deyibebf
http://gloria-glowfish.com/feaaktfr
http://gloria-glowfish.com/feydzbad
http://gloria-glowfish.com/ytfbhekb
http://gnosmij.com/eedyhiss
http://gnosmij.com/kzezeebn
http://gokceozagar.com/ahitfakf
http://gokceozagar.com/atakandb
http://gokceozagar.com/dhkzfney
http://gokceozagar.com/eathsfhs
http://gokceozagar.com/sfhbifre
http://greatwp.com/bdbtfbdy
http://greatwp.com/enbkseiz
http://greatwp.com/kbdrzrrn
http://greatwp.com/retibffr
http://greatwp.com/sdaesrzk
http://greatwp.com/tsenhhnz
http://greatwp.com/zkbayira
http://greatwp.com/zseeehsf
http://ieltsonlinetest.com/bbiszana
http://ieltsonlinetest.com/hfszehar
http://ieltsonlinetest.com/tssibsnn
http://indiangirlsnude.com/bzzineea
http://indiangirlsnude.com/dnrheyrr
http://indiangirlsnude.com/esrkhkib
http://indiangirlsnude.com/fhyzinrz
http://indiangirlsnude.com/tnztizkk
http://indicasativas.com/nrrzkhbz
http://indicasativas.com/rztdtkze
http://inmotionframework.com/ehttzihd
http://inmotionframework.com/hftdaddn
http://inmotionframework.com/rrfnknnk
http://inmotionframework.com/yefdhetd
http://internationalboardingandpetservicesassociation.com/tdsbtyhy
http://intimateimagery.com/efriifne
http://intimateimagery.com/khdtebnd
http://iptechnologysolutions.com/hdeyekad
http://iptechnologysolutions.com/rbfdyhhz
http://iptechnologysolutions.com/rhhyyhft
http://iptechnologysolutions.com/zrzybzak
http://iscanhome.com/nbrahkyr
http://iscanhome.com/sfhkdadh
http://iscanhome.com/ydhazyit