#MalwareMustDie! Monitoring INTERNET.BS base Kelihos Domain

// MalwareMustDie | @unixfreaxjp
// extracting INTERNET.BS database to check possibilities of further Kelihos used domains
//
// From today moving backwards / August 2013...
// With grep formula of Kelihos payload domain:
// "\][a-z]\{7\}\."

   8/5
   8/4
   8/3
   [61]cedarfx.com
   [107]gmailyr.com
   [179]poxitan.com

   8/2
   [185]liwuzan.com

   8/1
   [128]ebooksh.com
   [206]kozvain.com

   7/31
   [108]cmayson.com
   [114]cuntala.com
   [178]harmoza.com

   7/30
   [34]abizaga.com
   [38]adelska.com
   [56]baikept.com
   [96]chagabi.com

   7/29
   [22]arcoiro.com
   [32]beebibl.com
   [80]garonda.com

   7/28
   7/27
   [23]aakawir.com
   [39]buyitny.com
   [147]narotek.com

   7/26
   [137]exocant.com
   [197]jptubes.com

   7/25
   [64]bendoze.com
   [72]bitopup.com
   [74]borless.com
   [186]fxplain.com
   [212]hjfglcq.com

   7/24
   [51]betelcj.com
   [159]johress.com
   [171]kingdls.com
   [173]kloessl.com
   [197]lousich.com

   7/23
   [34]allnero.com
   [124]dadiego.com
   [194]hosttox.com
   [202]ingdelo.com

   7/22
   [80]claryum.com
   [112]digisrc.com
   [118]dumaxtv.com
   [152]gdogsoi.com
   [160]goodtor.com
   [174]herotor.com

   7/21
   [29]apexacs.com

   7/20
   [127]kasiras.com
   [191]pohydet.com

   7/19
   [50]appstrk.com
   [60]autooan.com
   [176]domkran.com

   7/18
   [62]badvets.com
   [140]dvdmvie.com
   [196]javdivx.com
   [200]jenbuys.com

   7/17
   [97]gmailor.com
   [99]golwins.com

   7/16
   [147]msutown.com

   7/15
   [47]aoiyume.com
   [107]btcmbay.com
   [119]caffema.com
   [155]combpen.com
   [199]dwnlder.com

   7/14
   [23]apptrkz.com
   [171]joancat.com
   [205]mqclick.com

   7/13
   [32]arbitrs.com
   [100]lebrend.com

   7/12
   [39]amtrakm.com
   [109]coopcer.com
   [137]evohack.com
   [171]hanetta.com

   7/11
   [42]babdior.com
   [50]birauto.com
   [54]bizraye.com
   [80]chalyng.com
   [96]donalld.com
   [188]jinable.com
   [194]juniorm.com

   7/10
   [51]babllon.com
   [53]baixyng.com
   [55]bayxing.com
   [57]belinug.com
   [165]makroob.com
   [167]maktoon.com
   [199]msktoob.com

   7/09
   [57]ecucare.com
   [63]foodliy.com
   [69]googlss.com
   [199]tdguide.com

   7/08
   [43]bamamei.com
   [69]corseco.com
   [95]flixerr.com
   [103]googelr.com
   [201]skinpks.com

   7/07
   [106]ahmshea.com
   [118]aisleme.com

   7/06
   [19]adcoves.com
   [91]ektobly.com
   [139]musbeat.com
   [181]seoytao.com

   7/05
   [31]bbfindr.com
   [153]gtecltd.com
   [171]janethi.com

   7/04
   [61]beoking.com
   [145]esyfany.com
   [147]evoldar.com
   [155]femixil.com
   [185]hkotels.com
   [187]hobplus.com
   [191]hoctels.com
   [193]hoktels.com
   [197]hotcels.com
   [199]hotuels.com

   7/03
   [106]diyidun.com
   [188]itaxico.com

   7/02
   7/01
   [36]awcream.com
   [54]bluesjy.com
   [98]ddhjxgs.com
   [212]lcclove.com

   6/30
   [29]ahzixuz.com
   [49]bydilig.com
   [55]ciqunim.com
   [79]erkyfzu.com
   [105]ggzuche.com
   [107]gipopef.com
   [121]hosukak.com
   [123]hyciqeg.com
   [143]ijyhteh.com
   [145]ikaoxun.com
   [195]kawkyik.com
   [203]kyilbyb.com
   [211]lodopif.com

   6/29
   [157]mufuzhu.com
   [197]ravepvp.com

   6/28
   [180]gmailex.com

   6/27
   [128]coupago.com
   [130]coupalo.com
   [138]dallenk.com
   [178]factler.com
   [202]gwokart.com

   6/26
   [58]bamonef.com
   [72]bysymsy.com
   [120]driplix.com
   [126]ebonnet.com
   [182]hostgix.com
   [198]inkoweb.com

   6/25
   [56]apptiss.com

   6/24
   [33]aeclick.com
   [41]amaraly.com
   [57]avtoneo.com
   [65]bewacht.com
   [73]bnpimap.com
   [101]cefothe.com
   [133]cqzgedu.com

   6/23
   [56]askword.com
   [80]canbids.com
   [122]derment.com
   [124]dhampus.com
   [136]dramaaz.com
   [202]hotjave.com

   6/22
   [87]diezzie.com
   [197]mrrhelp.com

   6/21
   [40]asicgen.com
   [50]barkwiz.com
   [172]hubroma.com

   6/20
   [90]celebko.com
   [208]hanouty.com

   6/19
   [39]bibiker.com
   [75]convors.com
   [91]disneyt.com
   [141]goosoma.com
   [145]guialou.com
   [207]myracom.com

   6/18
   [57]amygoal.com
   [113]bunskus.com
   [167]cutpoem.com
   [183]davujuz.com

   6/17
   [115]anwarix.com
   [123]appicat.com
   [127]appidog.com
   [137]arcshit.com
   [153]aryncis.com
   [185]axecash.com
   [187]axubsyz.com

   6/16
   [34]acnenew.com
   [102]aulabox.com
   [158]bokehon.com

   6/15
   [49]bigunol.com
   [55]bopokon.com
   [95]cubcuyl.com
   [109]dijjuvi.com
   [113]docibix.com
   [119]ehnexuk.com
   [121]eletmop.com
   [123]elmiraj.com
   [135]exsoczu.com
   [143]filodit.com
   [149]fobgieh.com
   [151]focadic.com
   [155]gogmyyw.com
   [159]gridnon.com
   [169]helpcsm.com
   [175]huditqa.com
   [185]ipwodir.com
   [187]irhetpy.com
   [191]jufafyz.com
   [193]kavrihu.com
   [199]legupsi.com
   [203]lilozyz.com
   [209]lorishy.com
   [211]lupafol.com

   6/14
   [64]cantail.com
   [140]framino.com
   [144]gamsers.com

   6/13
   [94]btweetn.com
   [96]bylucia.com
   [186]dopedil.com

   6/12
   6/11
   6/10
   6/09
   [18]mathevo.com

   6/08
   6/07
   [126]cehinsa.com

   6/06
   [84]beuhnim.com  <==== UNSPOTTED KELIHOS DOMAIN #1
   [138]dusseva.com <===== UNSPOTTED KELIHOS DOMAIN #2
   [144]enygnaq.com <===== UNSPOTTED KELIHOS DOMAIN #3
   [192]gulfkat.com <===== UNSPOTTED KELIHOS DOMAIN #4

   6/05
   [108]cvdpics.com
   [120]dvdsden.com
   [142]gmailup.com
   [178]ipiante.com
   [180]jangust.com
   [212]logusea.com

   6/04
   [136]cltrack.com

   6/03
   [62]ahonele.com
   [70]aulinas.com
   [122]credimy.com
   [166]gbgdoha.com
   [170]gibooks.com
   [182]hbsldzs.com
   [212]ivaness.com

   6/02
   [106]achievu.com
   [108]achrnew.com
   [126]adtview.com
   [128]adtvtoc.com
   [142]aflover.com
   [168]alepocp.com
   [182]allouet.com

   6/01
   [57]buytors.com
   [95]fitserk.com
   [111]helprrg.com
   [143]mirzabd.com
   [171]mytilac.com
   [183]nsphone.com

---
#MalwareMustDie!
@unixfreaxjp bash-3.2$ date
Tue Aug  6 20:25:55 JST 2013