hxxp://skylabs-heidelberg[.]com
hxxp://hevostat[.]biz
hxxp://inteli-geek[.]com
hxxp://freemobilehacks[.]com
hxxp://webmonetizing[.]com
hxxp://freshteengalleries[.]com
hxxp://freshteentubex[.]com
hxxp://pzfloor[.]com - Email: [email protected]
hxxp://hevostat[.]com
hxxp://skylabs-heidelberg[.]net
hxxp://cm-status[.]cn
hxxp://crimemarket[.]cn

hxxp://topnulled[.]com - Email: [email protected] - hxxp://nulledhard[.]com; hxxp://tunistuff[.]com; hxxp://0dayscripts[.]com - MD5: 2fa9723f4dd806d3313e800e2b107a52
hxxp://xxxchili[.]com
hxxp://upvote-me[.]com
hxxp://adult-bunny[.]com
hxxp://freshxtube[.]com
hxxp://allabouthentai[.]com
hxxp://mylittleasiancutie[.]com
hxxp://nasty-nuts[.]com

hxxp://coregamerz[.]net
hxxp://the4s[.]at
hxxp://nastynetwork[.]net
hxxp://nastynut[.]com
hxxp://freshteen18[.]com
hxxp://tattoo-trend[.]com
hxxp://red-fap[.]com
hxxp://topvidx[.]com 

Related domain registrations using [email protected] include:

hxxp://mylittleasiancutie[.]com
hxxp://nasty-nuts[.]com
hxxp://inteli-geek[.]com
hxxp://freemobilehacks[.]com
hxxp://webmonetizing[.]com
hxxp://freshteengalleries[.]com
hxxp://freshteentubex[.]com
hxxp://red-fap[.]com
hxxp://topvidx[.]com
hxxp://topnulled[.]com
hxxp://xxxchili[.]com

hxxp://upvote-me[.]com
hxxp://adult-bunny[.]com
hxxp://freshxtube[.]com
hxxp://allabouthentai[.]com
hxxp://coregamerz[.]net
hxxp://nastynetwork[.]net
hxxp://nastynut[.]com
hxxp://freshteen18[.]com
hxxp://tattoo-trend[.]com

Related emails known to have been involved in the campaign include:

hyipforumbiz[.]gmail.com