Compromised GoDaddy domains - Nov 14, 2013

Thu, Nov 14, 2013
#DhiaLite - New campaign of malicious subdomains hosted on 144.76.137.24 injected under compromised GoDaddy domains.

Traffic surge then it dies out.

Subdomains have been resolving to 144.76.137.24 for the past 2 days, and more subdomains are still appearing on this IP.

#Sample compromised 2LDs:

aafigures.net
aamultimediaproductions.com
aamultimediaproductions.net
acseafood.co
aeratedwetlands.com
allstarsodcompany.com
alt-comic.com
alt-comic.net
altcomic.net
alt-movie.com
alt-movie.net
animationtrack.com
betweenthebreadnola.com
betweenthebreadnola.info
betweenthebreadnola.net
carassia.com
easyvaper.com
ecozapp.co
eventplannershandbook.com
fluxintegratedsolutions.com
growgalloway.com
ieppumps.com
independentlifecare.com
insidedowntheline.com
karamco.org
knutsonpublications.co
myracingline.com
nutri-innovations.com
omnicareny.com
paradiseislandclub.com
pvcphotography.com
reevangelization.com
regstudio.com
salestaxbrokerage.com
smart2scan.com
strongsidelb.com
theplacetofindit.info
ushop2fund.net
xowii-racing.com

#Sample subdomains on 144.76.137.24:

zopainkillersprokkelde.acseafood.co
yulan.acseafood.co
woonstenbombable.knutsonpublications.co
ueberwiesest.easyvaper.com
tmptail-ongemaalde.acseafood.co
tissohojatoleslam.salestaxbrokerage.com
tenuitycentropages.easyvaper.com
subgloboselyverlengbare.salestaxbrokerage.com
spathirhynchapanfluiten.smart2scan.com
spaserturen.knutsonpublications.co
skompilowany-afcio1.acseafood.co
sideman0sandeman.smart2scan.com
secundemusqueshyoffset.salestaxbrokerage.com
schwebendes-nearresembling.growgalloway.com
schiaccia-dilemmic.omnicareny.com
savonlinnanpunitional.salestaxbrokerage.com
rusperiodes.salestaxbrokerage.com
pieken.knutsonpublications.co
papertablenotplain.knutsonpublications.co
ogando.growgalloway.com
nahokuecrusadsorbierendes.acseafood.co
lutafhinnhlaka1.acseafood.co
lucidementivancicu6.knutsonpublications.co
larynges-maggotpi.smart2scan.com
koskenrannan.acseafood.co
konventionaalisiin.growgalloway.com
kohoa.smart2scan.com
kansallispuiston.smart2scan.com
jikadanp.growgalloway.com
gargolaschundle.smart2scan.com
fmgsttomoyoshfortrostan.growgalloway.com
femelle-limx.knutsonpublications.co
enemmtsaneerata.salestaxbrokerage.com
electrolizadora.salestaxbrokerage.com
dutsachtigekonstellasies.strongsidelb.com
divingbladderenleverais.salestaxbrokerage.com
disconnectedfrumenticio.easyvaper.com
dervaux-boundingbox.strongsidelb.com
debrocherturasser.acseafood.co
compendiosa-valget.smart2scan.com
assiderato.knutsonpublications.co
antimoniet.easyvaper.com
amygdaloncus.knutsonpublications.co
afgekrastenwachal.strongsidelb.com
affrrenuntiarenturque.growgalloway.com
adjustab.smart2scan.com
abessesateljeetoimistoa.growgalloway.com
1allabauerrsstati.growgalloway.com
verlassend.karamco.org
negurijepodunk.strongsidelb.com
csisw.karamco.org
cork.animationtrack.com
cord.altcomic.net
copy.alt-movie.net
copper.alt-movie.com
cook.alt-comic.net
control.alt-comic.com
conscious.aamultimediaproductions.net
connection.aamultimediaproductions.com
condition.aafigures.net
zuhaelter.ieppumps.com
zaaikorf-eingelebt.insidedowntheline.com
virdiegekhouery.fluxintegratedsolutions.com
verkiesingskantoor.myracingline.com
vegliatetietokoneillaan.nutri-innovations.com
valtionvirastossa.aeratedwetlands.com
valpo-khoresht.karamco.org
univhamburgonafkoopbaar.ieppumps.com
unisubirizendantennes.xowii-racing.com
underdesigned.xowii-racing.com
traplopersturbed.allstarsodcompany.com
tidsmaskinen-fbmfree.myracingline.com
tendereque-nitrophe.eventplannershandbook.com
taudissa.carassia.com
taudinluokituksena.independentlifecare.com
tatonnaientdiktaattoria.karamco.org
sundergeld.insidedowntheline.com
strapwor.ieppumps.com
specrum-refute.ushop2fund.net
somerbesielanexa.theplacetofindit.info
shela.regstudio.com
ryskattenhierarchi.regstudio.com
retinols-hajuttomia.insidedowntheline.com
respirassi-chap0.reevangelization.com
remainedeleet.eventplannershandbook.com
quezstudentenkamer.aeratedwetlands.com
pzxdwlspmtomciu.eventplannershandbook.com
pc2479.regstudio.com
pauzej-conueniverit.nutri-innovations.com
parsehostandfilename.myracingline.com
ovporien.aeratedwetlands.com
oestandeepsouthpiano.ecozapp.co
nomismatainterrep.myracingline.com
mulou.insidedowntheline.com
minuend0-geassimileerden.paradiseislandclub.com
minanibaafgerenden.ecozapp.co
microsommite-superuse.allstarsodcompany.com
medestudenten.allstarsodcompany.com
matela-lithographs.nutri-innovations.com
lowew.ieppumps.com
liittotasavaltalaiset.strongsidelb.com
lastenpsykiatri.nutri-innovations.com
lanceolately.eventplannershandbook.com
laani.myracingline.com
kunsthandlereafgekapsel.xowii-racing.com
kreardon-sawacc.xowii-racing.com
kleinzerigerprominili1.ieppumps.com
kaolack.ushop2fund.net
joutuneellebutyrically.regstudio.com
jlkiviisaasti.myracingline.com
jlecountbenevel.aeratedwetlands.com
invoegsel.myracingline.com
hypedaises.nutri-innovations.com
hydrates.aeratedwetlands.com
hestitantlyintrucduced.eventplannershandbook.com
grundigtsalakuljetukset.strongsidelb.com
gowk-schermutsel.ushop2fund.net
goubilgambrellprocapitalists.theplacetofindit.info
geflikkerd.regstudio.com
ftbhnrsnjacs2-eigenstaendig.ushop2fund.net
fratelli.insidedowntheline.com
exitstatus.karamco.org
ewakuacyjny.ieppumps.com
eskzoptionholders.eventplannershandbook.com
encopetada.regstudio.com
eejfh-ookuroblindtarm.carassia.com
doczytam-oncologist.ieppumps.com
deutschlsofwaru.eventplannershandbook.com
desappritneuvostoliiton.theplacetofindit.info
dedoubleronsasplundilta.strongsidelb.com
cshrc0.regstudio.com
colorcard-meduser.aeratedwetlands.com
codesmithzalecenie.allstarsodcompany.com
ccmduiprzybiecverdanen.eventplannershandbook.com
bologninidelapla.ecozapp.co
blastingcircuit.nutri-innovations.com
bimmlerinfeliz.karamco.org
biheight-zottebolde.myracingline.com
beendersoepverminate.ushop2fund.net
balocheoorheerlik.regstudio.com
asscher.ecozapp.co
artefakte.karamco.org
apostemoso.aeratedwetlands.com
antireversezerschiessendes.ushop2fund.net
anguillarumvalmisteita.nutri-innovations.com
ambtskledij.insidedowntheline.com
afvaardigingsfusingdisk.xowii-racing.com
adaptability.aeratedwetlands.com
1schemepostpones.karamco.org
unguuntqueimiqpostcentral.pvcphotography.com
maximaliserentvertimet.betweenthebreadnola.info
kieltytymisperusteina.pvcphotography.com
zeitungsredakteur.pvcphotography.com
weltlagenisingstar.betweenthebreadnola.info
viridinegabeller.betweenthebreadnola.com
veldtekens.betweenthebreadnola.info
sycophanciesassoneerde.pvcphotography.com
rideraie.pvcphotography.com
ressaida-medrec.betweenthebreadnola.net
petalifostuderen.betweenthebreadnola.net
pelasgiscytoblastema.betweenthebreadnola.net
partiolainen-jparkyn.betweenthebreadnola.com
oormakings-eens.pvcphotography.com
onderbuik-wellparagraphed.pvcphotography.com
odgovorno2.theplacetofindit.info
nlbbnettwelvecut.theplacetofindit.info
nieskazitelnosc.betweenthebreadnola.net
newelboogzbeszczeszczeniem.betweenthebreadnola.com
marssoninasecundaverasque.betweenthebreadnola.net
maigreletsnwabi.betweenthebreadnola.info
libanontutaqueintexemusque.betweenthebreadnola.com
kookoo.betweenthebreadnola.info
hypertekstinsbureeltje.pvcphotography.com
hydrometerological.ecozapp.co
foodpreservative.betweenthebreadnola.info
eheloseroujongmeisie.betweenthebreadnola.net
effettuatimsthods.betweenthebreadnola.net
dissimulentqueangefragte.betweenthebreadnola.info
desirade.theplacetofindit.info
crchh80operazioni.betweenthebreadnola.com
colmikspsiakis.betweenthebreadnola.com
bobatica-zyunrets.betweenthebreadnola.net
apitoiem.betweenthebreadnola.com
antisepsin.betweenthebreadnola.com
adstititque-grouchiest.betweenthebreadnola.info

END