#DhiaLite- Suspicious domains Sep 4th, 2013

Wed, Sep 4th 2013
#DhiaLite - Suspicious subdomains started resolving today to same IP 66.199.231.164 that hosted www2.d-93mv3zwkzkt.co7.us which dropped Simda through Styx Exploit kit. Attack described on malware.dontneedcoffee.com in http://bit.ly/14zrpYt

vqtel.net registered on 2013-05-13

Watch for these.

#subdomains
www2.u9ac72z63.vqtel.net
www2.yte8si61hg5v2yxq8.vqtel.net
www2.g4xnun5iwsf3acqmt.vqtel.net
www2.ksadpr1d0em2l6ck-1.vqtel.net
www2.c6r3jx3y4uvqeump.vqtel.net
www2.ru64jxktmqvcgua9.vqtel.net
www2.ympq3jmqpojtep27.vqtel.net
www2.y2ifn46d5.vqtel.net
www2.lojk6ubgu6rz7pq46.vqtel.net

END