The first and easiest starting point that we identified was to look back at what was related to and still operational from the previous Tracking GhostNet report. We focused primarily on the domains described in GhostNet