CoolEK new port

@SetAbominae
CoolEK started to use :972 (in addition to :801), first observed 2013.08.21
<edit> Thanks to @MalwareSigs and @Trojan_Generic for pointing out that :801 is still active </edit>
-----------------------------------------------------------

Some recent examples:

fotograveurdesapegar.texasmobileshrinkwrap.com:972/opera-retain-make.html | 46.165.206.219
gegenden.shrinkwrapdallas.net:972/sunny-oak-trust-sock.htm | 178.33.69.93 |
j1moodylobulada.shrinkwrapsanantonio.info:972/interested-nut-differ.php | 91.231.87.64
lijmigebilateraalikaupan.texasmobileshrinkwrap.com:972/strongly_tread.php | 178.33.69.93
nchupihiriintynyt.shrinkwrapsanantonio.com:972/migrate_clever_eventual.htm | 92.63.98.246
oqg-karmeamman.texasshrinkwrap.net:972/transform-shovel_struggle.html | 46.165.206.219
perspektiivitnt.epicair.co:972/scrap_vertical_shit.htm | 46.165.206.219
tepidarium.txshrinkwrap.net:972/fantastic_woman-poet_everybody.htm | 46.165.206.219
vadlamani.texasshrinkwrap.net:972/radiation-young.htm | 178.33.69.93