John and Adam found almost 30 different URL shorteners used by this darkin hacking group. They kept enumerating and pulling out long URLs, then extracting target emails, which grew to thousands of email addresses in their database.