Later on, we've also come across some stylistic hits in IP ranges with apparent slight variations of the CGI comms pattern:
* no .cgi, but also http on subdomain:
  * dead:
    * https://web.archive.org/web/20100507132004/https://secure.developmental-league.com/login.html[]
    * https://web.archive.org/web/20110128182345/https://webmail.energy-bulb.com/login.html[]
    * https://web.archive.org/web/20110226074139/http://www.welcometonyc.net/login.html[]
* no subdomain, no https, no .cgi
  * live
    * https://web.archive.org/web/20091130144158/http://construction-zones.com/login.html[]
    * https://web.archive.org/web/20090405045548/http://nouvelles-d-aujourdhuis.com/members.html[]
  * dead
    * https://web.archive.org/web/20101230025246/http://guidetoelectronics.net/login.html[]
    * https://web.archive.org/web/20110128234749/http://messengergalaxy.com/login.html[]
    * https://web.archive.org/web/20100517071454/http://mide-news.com/login.html[]
Since these are so rare, it is still a bit hard to classify them for sure, but they are of great interest no doubt, as as we start to notice these patterns more tend to come if it is a thing.


CGI comms variant