Very bizarre that the article didn't touch on it.
The comment didn't explain it entirely but I figured all these domains pointed to a hosted content management system somewhere. Then that domain either expired or it was CNAMEs the whole way down to some "cloud" providers' default generated DNS (eg nvidia-hosted-cms.azurewebsites.net
). Or they all used the same CMS which had an exploit developed for it.
Happened to EA's Steam competitor before: https://www.bleepingcomputer.com/news/security/ea-fixes-origin-game-platform-to-prevent-account-takeovers/
Possibly crows, they did this to me once. I heard them pretending to be my mom, who was not home, but fed them accidentally and talks to them when they show up. Seemed like they did it to trick another crow into flying to check for food, then laughed at him.