Compromised GoDaddy domains - Nov 21, 2013

Thu, Nov 21, 2013
#################################In Memoriam: John F. Kennedy#################################

#DhiaLite - New campaign of suspicious subdomains injected under compromised GoDaddy domains on 3 different IPs:
78.47.161.134
78.47.161.138
78.47.161.141

Subdomains have started resolving to these IPs today. There are still a few subdomains on these IPs, which might indicate the campaign is still in the early stage.

EK to confirm.

#Sample compromised 2LDs:
allthingsscooter.com
bicicletta.cc
davidii-online.com
gpinstruments.info
sellingsoccer.com
thecountryboys.net
thezledger.com

#Sample subdomains on
78.47.161.134
78.47.161.138
78.47.161.141

tuskaisetkymmenienkin.gpinstruments.info
signiezmaailmankaupassa.sellingsoccer.com
kuondolewaerehtymttmyydest.thezledger.com
glattgestrichenen.thezledger.com
bundesratsbank-0aniline.thezledger.com
brinkmanniiunrestricted.gpinstruments.info
yhdentyneenomenantuottajista.thecountryboys.net
westyellowstone.thecountryboys.net
unblendablelmjm.gpinstruments.info
ultraenthusiasm.thecountryboys.net
tobaccobarn.sellingsoccer.com
sudnici1kleurenf.allthingsscooter.com
rietschuttingmedestanders.thecountryboys.net
przedstawione.davidii-online.com
paikallisradiolupa.thecountryboys.net
nakayoshi.davidii-online.com
kehitysjoukkoihin.thecountryboys.net
herstempelingvalistavat.sellingsoccer.com
hamadryad.sellingsoccer.com
glotoniaroutermux.davidii-online.com
gingivolabial.thezledger.com
diatropismringfor.thecountryboys.net
cashing.sellingsoccer.com
beschrijvingsobrescrito.bicicletta.cc
bastardmargaret.thecountryboys.net
afgevlogkkopysty.sellingsoccer.com

END

#################################In Memoriam: John F. Kennedy#################################