I bet they are running Google and Meta ads to generate traffic to these malicious domains.