Excel file download domain pattern

BazaCall is a campaign that manipulate users into calling a customer support center, where they are instructed to download an Excel file to unsubscribe from a phony service. When the user opens the Excel file, they are prompted to enable a malicious macro that infects their device with BazaLoader. This query surfaces connections to the distinctive .xyz domains that the BazaCall campaign uses to host malicious Excel files.