The .es domains that host the malicious content, like the fake Microsoft sign-in portals, are in most cases randomly ...