Good Morning,
While researching a wave of what other analysts alerted as Emotet/Geodo I found 128 different domains that are hosting the javascript based downloader and the payloads.
The list of domains can be found at the following Pastebin, I dont want to link them here as Google will mark my blog malicious if I hotlink the malicious pages.
Pastebin Link:
Hello, thank you for writting this!