An investigation into the BigBear 2.0 phishing operation examines 38 network indicators of compromise, identifying 81 potential victim IP addresses and more than 1,000 related domains through DNS, WHOIS and threat intelligence analysis.