Compromised GoDaddy domains - Oct 31, 2013

Thu, Oct 31 2013
#DhiaLite - A new set of malicious subdomains hosted on 176.31.59.112 injected under compromised GoDaddy domains.

Subdomains started resolving to 176.31.59.112 just 2 days ago. It is likley to see more subdomains pop on this IP.

#Sample subdomains on 176.31.59.112

tarusaovervurdering.myannuitychoice.com
stantaneouslymotallebi.myannuitychoice.com
slowspreading.1800docnow.com
skildvormige-offsetge.myannuitychoice.com
skifahren.myannuitychoice.com
lmorris.1800docnow.com
karipides-keffert.myannuitychoice.com
imoupineyksinkertaiselta.1800healthservices.com
eisenwarenhaendler.safestartegyadvisors.com
crosssymmetric.1800docnow.com
uebermalenden.thenutsnboltsof.com
tastaturblockkunsprodukte.mothersagainstillegalamnesty.com
storingvembaucho.ready4air.com
spornst.nutsnboltsof.com
somiteaberkenn-eriyttmist.mothersagainstillegalamnesty.com
robelmonte.podenterprises.co.uk
rhinocau-miodeen.nutsnboltsof.com
rannikkopatteristossa.fleatiquipawn.com
preanticgeruegt.ready4air.com
pipilechopro-centilitro.fleamartiques.com
multiplefamilystauntest.fleatiquipawn.com
milintasaiairskennisdrang.ready4air.com
korrekturlaestportauela.mothersagainstillegalamnesty.com
karyuuka.mothersagainstillegalamnesty.com
kansalliskokouksen.ready4air.com
izetareplayserv.fleatiquipawn.com
evasivelusbnetputeoli.nutsnboltsof.com
enclothe.mothersagainstillegalamnesty.com
dileguaticonchograss.fleatiquipawn.com
boxeoaffinons.fleatiquipawn.com
benit.citizensinvestigativeservice.com
asukasluvun.nutsnboltsof.com
assujettisseztouchoverlap.nutsnboltsof.com
analysemetoderheinamaki.ready4air.com
triomphaliste.fleamartiques.com
schachtler.fleamartiques.com
naashonkototara.fleamartiques.com
gedenkenis.fleamartiques.com
epaissiraskringe.fleamartiques.com
boursoufleront.fleamartiques.com
blandnesrrcottin.fleatiquipawn.com

END