Suspicious .pl short lived subdomains - Nov 12, 2013

Tue, Nov 12 2013
#DhiaLite - Suspicious short lived .pl subdomains started resolving to 5.152.194.51 for the past 6 days and still going on.
Spike in traffic for these subdomains then they stop resolving.

Possibly used for a similar Malvertising -> EK -> ransomware campaign as in
http://www.malekal.com/2013/07/31/en-urausy-adultfriendzfinder-malvertising-banner/

Yet to be confirmed.

Currently about 1200+ subdomains have resolved to this IP, and more are popping up.

These subdomains are registered under the Polish cities 2LDs

malbork.pl
olecko.pl
opole.pl

#Sample of 200 subdomains on 5.152.194.51

ultra.bu2z.olecko.pl
zombi.teach-english-travel-overseas.olecko.pl
yuzel.costuraexterna.olecko.pl
xxnxn.jemontremesseins.olecko.pl
workw.yelk.olecko.pl
wific.codeforge.olecko.pl
verct.domovanje.olecko.pl
varme.domovanje.olecko.pl
ultra.bu2z.olecko.pl
txtwe.best-directory-submission.olecko.pl
takac.jemontremesseins.olecko.pl
stuff.jemontremesseins.olecko.pl
skate.bu2z.olecko.pl
simit.icefairystreasurechest.olecko.pl
shenz.app.olecko.pl
rocas.codeforge.olecko.pl
riage.yelk.olecko.pl
ready.yelk.olecko.pl
radio.fulltrafico.olecko.pl
priva.snipon.olecko.pl
premi.quitenicestuff.olecko.pl
posrb.quitenicestuff.olecko.pl
plytk.codeforge.olecko.pl
pgfou.domovanje.olecko.pl
over5.yelk.olecko.pl
onlin.costuraexterna.olecko.pl
minju.fulltrafico.olecko.pl
mento.best-directory-submission.olecko.pl
mamab.snipon.olecko.pl
magic.codeforge.olecko.pl
macca.app.olecko.pl
luxus.app.olecko.pl
luxur.snipon.olecko.pl
lkcpr.snipon.olecko.pl
ljz.best-directory-submission.olecko.pl
lansi.costuraexterna.olecko.pl
kilif.codeforge.olecko.pl
keris.domovanje.olecko.pl
katal.app.olecko.pl
jimth.best-directory-submission.olecko.pl
inter.app.olecko.pl
indan.yelk.olecko.pl
huges.quitenicestuff.olecko.pl
hotwi.snipon.olecko.pl
homev.costuraexterna.olecko.pl
hitba.bu2z.olecko.pl
helle.best-directory-submission.olecko.pl
hedbe.jemontremesseins.olecko.pl
gruss.app.olecko.pl
gorod.costuraexterna.olecko.pl
game8.icefairystreasurechest.olecko.pl
freel.snipon.olecko.pl
freed.best-directory-submission.olecko.pl
foroa.teach-english-travel-overseas.olecko.pl
fneco.teach-english-travel-overseas.olecko.pl
fdtim.bu2z.olecko.pl
fbc.codeforge.olecko.pl
fande.icefairystreasurechest.olecko.pl
enven.domovanje.olecko.pl
emark.fulltrafico.olecko.pl
drfut.fulltrafico.olecko.pl
dollm.icefairystreasurechest.olecko.pl
dogho.teach-english-travel-overseas.olecko.pl
devge.fulltrafico.olecko.pl
depin.teach-english-travel-overseas.olecko.pl
darts.domovanje.olecko.pl
daily.snipon.olecko.pl
conti.icefairystreasurechest.olecko.pl
codeb.costuraexterna.olecko.pl
cindy.teach-english-travel-overseas.olecko.pl
cgaux.icefairystreasurechest.olecko.pl
bepre.yelk.olecko.pl
backu.quitenicestuff.olecko.pl
arbco.jemontremesseins.olecko.pl
ahcep.jemontremesseins.olecko.pl
conne.fulltrafico.olecko.pl
zzsld.nacionred.olecko.pl
zp.guideautoweb.opole.pl
zipsh.idiotsguidetowebtraffic.opole.pl
yamag.hondavodam.opole.pl
world.jasonsavard.opole.pl
wisht.cybermodeler.opole.pl
winkp.places-finder.opole.pl
whoca.dailyguideghana.opole.pl
wettm.uppervolta-3d.opole.pl
websi.sergey-mavradi.opole.pl
webco.selfmadevip.opole.pl
web12.winiary.opole.pl
wapan.th.opole.pl
vitri.chevrolet.opole.pl
versa.winiary.opole.pl
venga.missyuan.opole.pl
vctvb.graz.opole.pl
vazhn.travel-wonders.olecko.pl
valut.thaiproperty.opole.pl
unifo.uppervolta-3d.opole.pl
unfor.autoclubrevolution.opole.pl
under.dictio.opole.pl
turio.srilankamirror.opole.pl
tropi.clothingshowroom.opole.pl
trade.netaxle.opole.pl
toron.joomleague.opole.pl
topnu.hondavodam.opole.pl
tikku.winesworld.opole.pl
thewi.belambra.opole.pl
thefu.a7lahmsa.olecko.pl
testi.go.opole.pl
targe.findjob.opole.pl
tanka.nacionred.olecko.pl
tacom.uppervolta-3d.opole.pl
symco.wikivs.opole.pl
sweet.uppervolta-3d.opole.pl
surfm.winesworld.opole.pl
sulta.autoclubrevolution.opole.pl
strea.idiotsguidetowebtraffic.opole.pl
stefy.netaxle.opole.pl
stdut.thaiproperty.opole.pl
stcc.carmamail.opole.pl
start.lopesnet.opole.pl
stark.autoclubrevolution.opole.pl
star5.lopesnet.opole.pl
stafe.cakemail.opole.pl
sport.ocala4sale.olecko.pl
sport.joomleague.opole.pl
splic.srilankamirror.opole.pl
soosc.graz.opole.pl
sonys.nacionred.olecko.pl
socia.go.opole.pl
socia.afroterminal.opole.pl
sksap.sbart.opole.pl
sirii.srilankamirror.opole.pl
sinka.sbart.opole.pl
siddh.jasonsavard.opole.pl
shuim.graz.opole.pl
shema.blacks.opole.pl
sette.belambra.opole.pl
serve.carmamail.opole.pl
seosh.thaiproperty.opole.pl
sende.carmamail.opole.pl
seaw4.missyuan.opole.pl
searc.comofazertudo.opole.pl
saida.selfmadevip.opole.pl
rsi.nacionred.olecko.pl
rouss.bridalexposure.opole.pl
rosam.netaxle.opole.pl
rifai.idiotsguidetowebtraffic.opole.pl
rentc.blacks.opole.pl
regul.cubovision.opole.pl
redfo.srilankamirror.opole.pl
redbu.a7lahmsa.olecko.pl
realf.mafiavza.opole.pl
realc.winiary.opole.pl
qiel.sbart.opole.pl
prolt.autoclubrevolution.opole.pl
prois.blacks.opole.pl
prefe.go.opole.pl
prati.graz.opole.pl
picky.belambra.opole.pl
pedab.comofazertudo.opole.pl
payak.szilvasbukta.opole.pl
pasma.places-finder.opole.pl
parem.lopesnet.opole.pl
pagin.bridalexposure.opole.pl
oye89.ocala4sale.olecko.pl
owlki.guideautoweb.opole.pl
ostaz.guideautoweb.opole.pl
nzabl.findjob.opole.pl
npiwo.colchaocostarica.opole.pl
notic.travel-wonders.olecko.pl
nomad.harimeyas.opole.pl
nmc.cubovision.opole.pl
nilof.jasonsavard.opole.pl
newmu.go.opole.pl
nerds.a7lahmsa.olecko.pl
nalog.dictio.opole.pl
muzot.afroterminal.opole.pl
mp3do.blacks.opole.pl
mozha.cakemail.opole.pl
morph.selfmadevip.opole.pl
monst.nacionred.olecko.pl
misfi.winiary.opole.pl
milse.carmamail.opole.pl
millo.cybermodeler.opole.pl
metat.cubovision.opole.pl
media.winesworld.opole.pl
maryl.ocala4sale.olecko.pl
manga.a7lahmsa.olecko.pl
lovit.cakemail.opole.pl
lente.afroterminal.opole.pl
last.a7lahmsa.olecko.pl
ktudo.go.opole.pl
kozuk.winesworld.opole.pl
kinde.hondavodam.opole.pl
kgun9.th.opole.pl
kense.cybermodeler.opole.pl
kajcs.chevrolet.opole.pl
kaiyo.findjob.opole.pl
kabar.cybermodeler.opole.pl
jobwe.wikivs.opole.pl
jetsk.lopesnet.opole.pl

END