https://blog.malwarebytes.com/security-world/2016/12/explain...
Although in this case, the generated domains are all under global.ssl.fastly.net and similar CDNs, not traditional TLDs.