Spam campaigns leveraging .tk domains

Zscaler ThreatLabZ observed an active campaign since at least May 2018 that uses compromised websites to inject obfuscated JavaScript redirectors to numerous .tk domains; those domains in turn redirect victims to fake blogging pages (ad fraud) and tech-support scam sites. The report enumerates thousands of .tk campaign domains (3,804), lists 72 fake-blog domains hosted at 162.244.35.55, provides example tech-support scam URLs and phone numbers, shows injection/obfuscation techniques, and estimates ad revenue of roughly $20K+ per month from the identified subset.