I'm noticing a tech support scam campaign with a theme in the domain name.  At least one of these was served by Google search malvertising and I think they all were.  What kills me is the search term was simply "facebook".  Why is that even purchasable at this point.

The first one I saw yesterday.

www[.]track100googleads[.]website
143[.]244.220.150

Then these came by today.  The base path is an open directory.

googleads100kms[.]agency/ilakafb/
googleads100kms[.]club/lanibobofb/
googleads100kms[.]club/lipapoti/
50[.]62.183.225

They're hosting the scam on Azure.

qktussbhelxy1fbgqprw.azurewebsites[.]net/4FQbQTDRV9z17aW84OJg/
zrgliql5waeszh7i7axm.azurewebsites[.]net/DUnMLrAWh4A1fPBTxsb6/

Anybody know of a handy method to search all known domains?  In this case search for "googleads" plus "100".

https://media.infosec.exchange/infosecmediaeu/media_attachments/files/111/172/298/494/087/352/original/78032209f547230e.png 

 @f0b14579 

googleads100[.]ru
googleads100kms[.]agency
googleads100kms[.]buzz
googleads100kms[.]club
googleads100kms[.]co
googleads100kms[.]info
googleads100kms[.]live
googleads100kms[.]online
googleads100kms[.]shop
googleads100kms[.]site
googleads100kms[.]space
googleads100kms[.]store
googleads100kms[.]website
googleads100kms[.]work
googleads100kms[.]xyz
track100googleads[.]blog
track100googleads[.]buzz
track100googleads[.]com
track100googleads[.]fun
track100googleads[.]info
track100googleads[.]live
track100googleads[.]shop
track100googleads[.]solutions
track100googleads[.]space
track100googleads[.]top
track100googleads[.]website
track100googleads[.]xyz