#DhiaLite- Callbacks used to host Kelihos doms Sep 2nd, 2013

Thu, Sep 2nd 2013
#DhiaLite - Domains mapping to IPs in Hosts list from http://pastebin.com/Q5ufz4Cu
I removed the google 8.8.8.8
A lot of these are infected home machines, that are most likely part of the Kelihos botnet.
The relevant IP is 46.172.237.163. It is confirmed to be part of the Kelihos botnet. It's been used to host the fast flux domains. All FF domains are dead now, except aqa.renuncam.nl. Is still alive.

#Kelihos FF domains list
abeeu.bobpawa.com 46.172.237.163 0
ximirsex.ru 46.172.237.163 0
teeply.info 46.172.237.163 0
aqa.renuncam.nl 46.172.237.163 0
cych.zymofevy.me 46.172.237.163 0
davujuz.com 46.172.237.163 0
cx3r5.nigucgu.com 46.172.237.163 0
nenkudyf.ru 46.172.237.163 0
dahadkyz.ru 46.172.237.163 0
fcegrrtc.mapuhxaf.ru 46.172.237.163 0
widerat.com 46.172.237.163 0
xexumyb.com 46.172.237.163 0
ogfonis.org 46.172.237.163 0
huznejex.ru 46.172.237.163 0
hsej0rr7.insomtab.nl 46.172.237.163 0
powerwik.ru 46.172.237.163 0
flowsre.com 46.172.237.163 0

#Full list
abeeu.bobpawa.com 46.172.237.163 0
ximirsex.ru 46.172.237.163 0
teeply.info 46.172.237.163 0
aqa.renuncam.nl 46.172.237.163 0
s01067cb21b32041d.vc.shawcable.net 24.85.82.3 900
j.maxmind.com 108.168.255.244 28800
j.maxmind.com 108.168.255.244 14400
j.maxmind.com 108.168.255.244 86400
j.maxmind.com 108.168.255.244 7200
webmailportal.info 12.192.118.250 3600
cych.zymofevy.me 46.172.237.163 0
davujuz.com 46.172.237.163 0
cx3r5.nigucgu.com 46.172.237.163 0
nenkudyf.ru 46.172.237.163 0
dahadkyz.ru 46.172.237.163 0
fcegrrtc.mapuhxaf.ru 46.172.237.163 0
c-71-238-72-5.hsd1.mi.comcast.net 71.238.72.5 7200
ool-43562fe7.dyn.optonline.net 67.86.47.231 86400
widerat.com 46.172.237.163 0
c-66-56-26-75.hsd1.ga.comcast.net 66.56.26.75 7200
c-76-27-32-6.hsd1.ut.comcast.net 76.27.32.6 7200
108.168.255.244-static.reverse.softlayer.com 108.168.255.244 86400
kandreas.desales.edu 147.106.5.3 28800
c-68-44-131-21.hsd1.de.comcast.net 68.44.131.21 7200
xexumyb.com 46.172.237.163 0
ogfonis.org 46.172.237.163 0
huznejex.ru 46.172.237.163 0
hsej0rr7.insomtab.nl 46.172.237.163 0
powerwik.ru 46.172.237.163 0
173-18-114-28.client.mchsi.com 173.18.114.28 86400
flowsre.com 46.172.237.163 0