A cyber campaign targeting East Asian elites leveraged fake web services. DNS forensics uncovered suspicious domains, IP links, and signs of future infrastructure repurposing.