good reporting from Krebs on Security:

“Who’s Behind the ‘Reopen’ Domain Surge?”