The current list of domains that attackers have already used. The list is regularly updated.

hal-cert.com,

hal-cert.net,

hal-dcs.com,

hal-ecert.com,

hal-ecert.com,

hal-varnost.com,

hal-varstvo.com,

halcert.com,

halcom-eu.com,

halcom-finance.com,

halcom-finservis.com,

halcom-id.com,

halcom-kapital.com,

halcom-mail.com,

halcom-pay.com,

halcom-placila.com,

halcom-podpora.com,

halcom-s.com,

halcom-si.com,

halcom-v.com,

halcom-varnost.com,

halcom24ur.com,

halcomauth.com,

halcomv.com,

hauth-si.com,

ispfinancni.com,

nexus-hal.com,

nexus-posta.com