fakedomain.com resolves to 1.1.1.1.

fakedomain.com has been known to distribute revil malware sent in email attachments from the email address fakedomain@email.com

revil is uses the att&ck techniques T1548, T1548.001 and T1650. As well as tools S1061 and S0677.