They don't. They look up random domains to get the info to send their crud and alter it to whatever host they happen to be using.