New malware domains on 5.254.101.32 - Oct 30, 2013

Wed, Oct 30 2013
#DhiaLite - New malware domains popped on 5.254.101.32 over the past 2 days beginning on Oct 28th.

Traffic surge, the IP is dropping fake AV and Urausy ransomware
https://www.virustotal.com/en/ip-address/5.254.101.32/information/

The domains are rapidly being disabled and pointed to localhost. Good job of .de folks !

Sample subdomains on 5.254.101.32.

whorevoyeurmaidslatex.de
socksanusjailzodiacs.de
lingeriekinkclubjeans.de
felchingfatbatforeplay.de
cowgirlindonesiannerdyflashing.de
bigcockfamilybloopershobos.de
aquariushairlesswhipinterview.de
agedcreampiebondageaccident.de
tauruspantiesblowjobfeet.de
laughingcucumbersilkbathing.de
hitch-hikerbfkoreanjuicy.de
fathandjobblowjobhardcore.de
blooperseroticofficeforced.de
bedroomegyptianpersonalbigclit.de
bananaintroblacklactating.de
ballerinabarebackingpantsblueeyed.de
backstagedickmouthfulzodiacs.de
anusfamilyteacherbicycle.de

END