Compromised GoDaddy domains - Dec 2, 2013

Mon, Dec 2, 2013
#DhiaLite - A new campaign of suspicious subdomains injected under compromised GoDaddy domains have started resolving to 5.199.134.97

There are still a few subdomains on this IP which might indicate the campaign is still in the early stage.

Confirmed Browlock domains thanks to @kafeine

#Sample compromised 2LDs

phillytrivia.com
phillyweddingdj.com
privatepartyrooms.net

#Sample subdomains on 5.199.134.97

fdtfghdt.privatepartyrooms.net
dgserg.privatepartyrooms.net
gvsert.phillyweddingdj.com
gvser.phillytrivia.com
fewffgae.phillyweddingdj.com
dsgre.phillytrivia.com

END