The plot thickened. John suspected that webxseries.com.qa might be a watering hole attack site, designed to harvest login credentials from specific targets. But what was the ultimate goal of the attackers?