Silent Ransom Group (Luna Moth): fake IT help-desk domains named <organisation>-itdesk.com

Domains ending in -itdesk.com, the naming public reporting attributes to Silent Ransom Group (also tracked as Luna Moth, Chatty Spider and UNC3753) for its fake IT help-desk domains: <organisation>-itdesk.com, where the organisation is a targeted law firm, defense or aerospace company, or consultancy. The group calls and emails staff while posing as their IT department, talks them into installing a remote-support tool, copies their data out and then extorts the organisation. These domains carry the group's email and usually show only a registrar parking page on the web, so a scan of one rarely shows a lure; what marks them is the name together with how they are registered: a low-cost registrar, its default DNS, and mail handled by that registrar's own mailbox or forwarding service.