Before the assadcrimes[.]info page was fully populated with decoy content, we found that the site was hosting a Persianlanguage mailer (See Figure 14 below). We were not able to determine how the mailer was being used by Group5, as it