Previously the fake website linked to the following documents in a third fake Oxford domain, oxford[.]in: http://oxford[.]in/downloads/ls1.doc http://oxford[.]in/downloads/ls2.doc http://oxford[.]in/downloads/ls3.doc http://oxford[.]in/downloads/ls4.do The documents were unavailable during our research, and their content is unknown to us