It's quite obvious that their descriptive nature, just like the ones I've discussed before, is to be used in phishing attacks in order to visually social engineer the receipts. And as you can see in the attached graphs, the IPs resolving to the domains are the typical home based infected end users, who would from a theoretical perspective be sending phishing emails to themselves at a later stage. And so once infected the hosts phone back home to receive instructions on participating in the malicius ecosystem by temporarily serving the phishing domains. Upon infection the hosts try to connect to 72.46.129.154; 72.46.130.154; 72.46.136.50 and ns.uk2.net, where for the time being there're twenty different variants that are known to have been using ns.uk2.net for DNS resolving purposes. All of these domains are using the same nameservers indicating their connection. Here are some of the subdomains in the already running, and spammed phishing campaigns :

Now that the botnet's phishing activities are exposed, it's also important to mention the fact that besides the phishing activities, this is the botnet that's been sending out the recent fake Microsoft Critical Live Update emails.