During a retrospective audit of a multinational corporation's logs, we found traces of communication with a suspicious domain dating back several years. If you scan this domain today, it will appear clean (antivirus engines no longer flag it). However, it served as critical infrastructure for one of the most massive cyber-espionage campaigns in history. The attacker made a fatal mistake: he used his personal information to register the domain.