[auslander]

> exploit code was delivered from a separate domain, analyticsfit[.]com

They paid some registrar for the domain. Can police request payment details? Can someone buy domain on stolen credit card?