Angler is constantly working to maintain its lead in the exploit kit arms race. Talos has discussed the sophistication of the Angler exploit kit. Recently we noticed some changes in Angler’s landing page syntax. In conjunction with this change we started seeing a new gate. The actor has been heavily leveraging the.top TLD and has been extremely active since the beginning of February registering dozens of domains daily. To date the actor has registered 737 domains with the first registration occurring on February 11th.”]
Source: https://blog.talosintelligence.com/2016/03/angler-slips-hook.html