The current list of domains that attackers have already used. The list is regularly updated.

hal-cert.com hal-cert.net hal-dcs.com
hal-ecert.com nexus-posta.com hal-varnost.com
hal-varstvo.com halcert.com halcom-eu.com
halcom-finance.com halcom-finservis.com halcom-id.com
halcom-kapital.com halcom-mail.com halcom-pay.com
halcom-placila.com halcom-s.com halcom-si.com
halcom-podpora.com halcom-v.com halcom-varnost.com
halcom24ur.com halcomauth.com halcomv.com
hauth-si.com ispfinancni.com nexus-hal.com
halcom-finservis.com isp-auth.com hal-inbox.net
hal-auth.net hal-mail.net oauth-1.com
halc-auth.com halc-m.com halco-3.com
halcm.com halcm1.com halcm2.com
halco-4.com
hal-ca.com hal-si.com
hal-slo.com hal-sl.com