#DhiaLite- Suspicious domains Sep 3rd, 2013

Tue, Sep 3rd 2013
#DhiaLite - Suspicious domains started resolving today to same IP pool used by the citadel cnc from
https://www.virustotal.com/en/file/05c3092123c2d220a3e531c2f0831f0c43a02e51ca90ec72f77196f8d9ceb2b8/analysis/1378223217/

#domains
thepohzi.su 2013-07-23 00:00:00
freedns.biz 2013-07-15 19:31:23
eevootii.su 2013-06-27 00:00:00
queiries.su 2013-06-12 00:00:00
wahemah.cc 2013-06-03 14:21:51
tohk5ja.cc 2013-06-03 14:09:33
oogagh.su 2013-06-03 00:00:00
kunvarji.co.in 2011-02-01 07:42:41

Similar pattern as in
http://pastebin.com/n1q4882P

#subdomains
yy3in9f5jlcmqlngtz.www5.queiries.su
uvjs2szribo1pezp5w.www5.queiries.su
qq2iwaq8q9tf7bdlms.www5.eevootii.su
f95kw4jmotqzq5wrlw.www5.eevootii.su
66lq88hsh1xt73jdja.www5.thepohzi.su
4jzolizot83pmefvnc.www5.thepohzi.su
2spj9tkgj9agrc4kc2.www5.thepohzi.su
yrfvlr4me7dl599v5.www5.eevootii.su
wkpo6vtymf9lpwbqb.www5.thepohzi.su
us5vqusjhgpixde8l.www5.queiries.su
u008ww3kchfqv4gdz.www5.thepohzi.su
rdm2rpytec51kt53v.www5.thepohzi.su
qz8orm0pfrrkwckkm.www5.eevootii.su
lsu2sge6zj8k9upqy.www5.thepohzi.su
l9kjy7c8ux2s1mith.www5.queiries.su
k6op29jj54cidd4ez.www5.thepohzi.su
iup8w0qqhcq55xfcv.www5.thepohzi.su
cmi3075ozmz437h6y.www5.queiries.su
c0kx1fhzr7o8u58v4.www5.eevootii.su
7j96jnv923b9byngd.www5.queiries.su
78pfwb4fhggq9dc94.www5.thepohzi.su
4oyhs4zrruuuhebmc.www5.thepohzi.su
0l2k6x8ycrecu8739.www5.thepohzi.su
u5o6rhwsd0n8k.youtube.queiries.su
tfpclcih8mv3rkms.www5.queiries.su
qiehlm27f57tuev2.www5.thepohzi.su
q3nwa0onyoajrwk3.www5.queiries.su
lv1htq49whr2rqqn.www5.thepohzi.su
ji6k8hndjgxouz9k.www5.thepohzi.su
6s7mzi44x07qujt9.www5.thepohzi.su
5tx1sbngcmxhnkv5.www5.queiries.su
0my94wfgrlat55mn.www5.thepohzi.su
w8h5juirix5tvwh.www5.thepohzi.su
w3et6jeizjl7b3l.www5.thepohzi.su
oi9wq8l3wn72ics.www5.thepohzi.su
of3v5g2985hyrwh.www5.eevootii.su
ocslz6se9xjz1ey.www5.queiries.su
oc3tc0qszmsikre.www5.queiries.su
ly7d3wx5ezggdde.www5.thepohzi.su
lkhnswc7h2jl0k9.www5.thepohzi.su
kpfzfcl6uldhtcf.www5.thepohzi.su
eujyucwj0b3e75c.www5.queiries.su
epbsqx5jch3dfl0.www5.thepohzi.su
d902rju2vjiu510.www5.thepohzi.su
bzswcimllpvvslv.www5.eevootii.su
bzhn651yu7t5lek0.www5.wahemah.cc
8vfmtlx8s7irvs4.www5.queiries.su
8j7ud9yp90e6hix.www5.thepohzi.su
6bs4yuhmeqfu47j.www5.thepohzi.su
1nbu0lk4ccz0a4l.www5.thepohzi.su
0o5lrbo4y08qmml.www5.thepohzi.su
zvpv97ulnx5.youtube.thepohzi.su
vonn80v0g4r.youtube.queiries.su
uym5qkcfyhsp42.www5.thepohzi.su
tujmvdnfnpsbnr.www5.thepohzi.su
nvq81sablhxpbfl.www5.tohk5ja.cc
noczv4jxwved21.www5.thepohzi.su
l4ibbckb98z5n3.www5.thepohzi.su
k1kp46z6u59rz0.www5.thepohzi.su
i3t2orkb1qmlo9.www5.thepohzi.su
h26wgpazmrufx0.www5.queiries.su
dfm735qibsfp1f.www5.thepohzi.su
arbnb8puhetz59u.www5.wahemah.cc
9sk705n3vclgw8.www5.eevootii.su
5bqfp2b2gxbru5.www5.queiries.su
56vrng967jkxup7.www5.wahemah.cc
424cn7f5f67wyj.www5.thepohzi.su
2qu99k15xgpmbfg.www5.wahemah.cc
wqxxmk0pfkjp7gw8sj.thepohzi.su
w9ay3z2lo3fhi.www5.thepohzi.su
shemrr7uoxhc6.www5.eevootii.su
o3sg6a0k2ylqo.www5.thepohzi.su
kfcnci4wgkvpi7q41d.queiries.su
kbksxnyo3o8pv.www5.queiries.su
eqenvmwb78h0o.www5.eevootii.su
dq5674cmik914bgbu6.queiries.su
9g3as4lvki28i.www5.eevootii.su
8bkb4cihnypf4.www5.eevootii.su
4rvh3iuhb5eqx1zl01.eevootii.su
1j2gsvfrjs2jg.www5.thepohzi.su
xz65zcj1zmnpc.www5.wahemah.cc
vyweo2t87xfa.www5.eevootii.su
tzy2bf8k14yqhss4y.eevootii.su
twtluecezygd.www5.queiries.su
sw6ckmgfgsbezpcjp.thepohzi.su
snaus2tppzq1.www5.thepohzi.su
sft58jqctfiy1.www5.wahemah.cc
p2zub5p4f0l9giw0r.thepohzi.su
mu4ckibp6tfsumii4d.tohk5ja.cc
msf0l6ynltql.www5.thepohzi.su
kyh2om0pkv7ojku0t.eevootii.su
kh2nzzt73ay6s96ut.queiries.su
ibg90umvln54.www5.thepohzi.su
hoiw36ltkn3b.www5.thepohzi.su
hhfxfkqbxxsd.www5.thepohzi.su
h6il3mk0r5ui.www5.thepohzi.su
g1vli87d5sdu7yxj8.queiries.su
cbmg0h84jtfz.www5.thepohzi.su
2mcchchh2bq2go8wy.thepohzi.su
wej4q51erb6y1p14.queiries.su
uvb8vrkj.youtube.queiries.su
swnekgfjtgr.www5.eevootii.su
o735wws9ghz2e8lv.queiries.su
my5636970zcj8tm0.thepohzi.su
lds798y022r.www5.thepohzi.su
j3rft15f7qxh8zghp.wahemah.cc
f9wmow1stxe.www5.thepohzi.su
ek4s0rp39l2.www5.queiries.su
cpp3ewwv7bb.www5.thepohzi.su
b3eq0wa57ec5pya2.queiries.su
9r6bl0rgg59tvbb1.queiries.su
9fd8nmxxl7nnjs0z.eevootii.su
846ww7r5ypu0.www5.wahemah.cc
7k3yla8ousdm2s97.queiries.su
6bh4nrk8p0w.www5.queiries.su
6aj8lhfxff7.www5.thepohzi.su
5vh4rtpbog94ieoz.queiries.su
4ozy9ldewa3.www5.thepohzi.su
4egyqzty32i7wz3n.queiries.su
4b29lqv7175.www5.eevootii.su
37elsss2v9e.www5.eevootii.su
2sdfb0gukn4.www5.thepohzi.su
05q0ev2tn5t.www5.thepohzi.su
viwf76y4p1.www5.thepohzi.su
v2vfgfp564gmugw.queiries.su
v1qtryor4m.www5.thepohzi.su
t5wgt23njjjc7li.thepohzi.su
sg8i7uha93vngnit.tohk5ja.cc
rof4ct0we1b.www5.wahemah.cc
pbmqfmsgb8y.www5.wahemah.cc
o1s7oemhry.www5.queiries.su
n3vw86lhvsxxc0v.eevootii.su
mzkpblp893g4422.eevootii.su
j9o79m0q1ytoic9.queiries.su
j99vc70euf.www5.thepohzi.su
inr6h5z22t.www5.queiries.su
gapenaesuferw6e.thepohzi.su
ezhv3hr6wt.www5.thepohzi.su
ew1351bl5u.www5.thepohzi.su
cjzsyi0h48.www5.queiries.su
bawo48p04qigglb.queiries.su
ao2k1ueo02x2fus.eevootii.su
7rd9eky96v72c4q.eevootii.su
5qq2y9z1hs7cyzyk.wahemah.cc
2ic00dregq.www5.thepohzi.su
ztft3e54m3.www5.wahemah.cc
y7pcuvwwve.www5.wahemah.cc
xtzsu4mv7rm3w4.eevootii.su
xfuqml6fv.www5.thepohzi.su
xa73rvu8qylhwlk.wahemah.cc
wz8q9u9s5.www5.queiries.su
vpfs6ks2o.www5.thepohzi.su
um17c7alosby2x.eevootii.su
rmwphw6yqrxbzx28.oogagh.su
r5tfskpsrl978x.eevootii.su
p1uoa2cdz.www5.thepohzi.su
ojp72icugj0ztj.queiries.su
nym7ckwlupwh2q.eevootii.su
mtz3htu327cqb1.eevootii.su
jbjccxl78.www5.thepohzi.su
i0tzrfre1.www5.eevootii.su
e47c10l1qd73sg.thepohzi.su
dbg1r629l.www5.thepohzi.su
9ulwd2my7.www5.queiries.su
9sv9gohcl.www5.queiries.su
8x0k09iuy.www5.thepohzi.su
8tyymr7fq.www5.eevootii.su
8lnj9xdpu2wam1.eevootii.su
72bw8gyu1.www5.thepohzi.su
5h6lzre27cokj2.eevootii.su
2rjn748lxspzbn.thepohzi.su
221asnocij2s4x6.tohk5ja.cc
1vs4oktrdjfkpb.thepohzi.su
1qh5mk6r1ipmq9.thepohzi.su
zxrep56l.www5.thepohzi.su
zqjxn29v95.www5.oogagh.su
zp6q19ty7kyb9.eevootii.su
zp1h6jz52.www5.wahemah.cc
yj19luyk.www5.thepohzi.su
wz71xxe0.www5.thepohzi.su
whghq5n3nhgvs.queiries.su
w3s11z8g.www5.eevootii.su
tyqmpcwl.www5.thepohzi.su
tya6suk3.www5.thepohzi.su
tfefdln6.www5.thepohzi.su
pau5752jt9lcb.eevootii.su
ozg9he46.www5.eevootii.su
otctoj7t.www5.thepohzi.su
oh63q7dy.www5.queiries.su
mnyey007.www5.thepohzi.su
lwn5rugq.www5.thepohzi.su
lwikkupato.kunvarji.co.in
l7rkdt9zm5idwf.wahemah.cc
ga65huzf.www5.queiries.su
exqgac4v84k4o.eevootii.su
edqkkrkx1xvldi.wahemah.cc
bv9fcx1t.www5.thepohzi.su
bnyjlng50ouwmz.wahemah.cc
6yhmh9ro.www5.eevootii.su
3vmllbtf72l7r.queiries.su
2vngysjf.www5.thepohzi.su
zt227i1.www5.thepohzi.su
vx617vxmk0nsk.tohk5ja.cc
v0444j2.www5.queiries.su
tyd0lccm6ym5.queiries.su
txg76h2.www5.eevootii.su
t3pl9459pe2w.queiries.su
t2pgsmr.www5.queiries.su
see4xzm50ouq.eevootii.su
nxc2jxt.www5.thepohzi.su
lwwc11ejmfh4u.tohk5ja.cc
l9youke6np13.queiries.su
l9c4jaj0fohx.eevootii.su
l0to0hkxb1c9x.tohk5ja.cc
f1xp6aqc51l7.eevootii.su
dq3kht12.www5.wahemah.cc
cxffmqh.www5.thepohzi.su
cehnjvt.www5.thepohzi.su
95lh24dhof6hs.wahemah.cc
7eekjuqcd5zb.queiries.su
5c7qu8ey0lknb.wahemah.cc
44z7ajrdowiq.eevootii.su
3r0p4dc.www5.thepohzi.su
1nxnvmm.www5.thepohzi.su
1gqm4jf.www5.queiries.su
voqcmx2.www5.wahemah.cc
v2ef5ehkuwtx.wahemah.cc
uy82qtp84ml.eevootii.su
unvkugmip0qm.wahemah.cc
twwgf6m5ttt.thepohzi.su
ti1iryiy5smz.tohk5ja.cc
q7ncwm.www5.thepohzi.su
p3jlxr.www5.thepohzi.su
kln9txhn6b6.thepohzi.su
kku4k0oc78w7.wahemah.cc
j4p2fi.www5.thepohzi.su
iz30ssdgffr.queiries.su
dkv75nvlbtu.queiries.su
d1kcvii.www5.tohk5ja.cc
b7n1kxl8deq.eevootii.su
9a5iylgt1er.eevootii.su
638uzx12dh8.thepohzi.su
2efp4i.www5.thepohzi.su
2c0er0.www5.thepohzi.su
th1k4je137.eevootii.su
sk294u1kpz.queiries.su
pb2cu80bgn.thepohzi.su
9ojbj4gumn.eevootii.su
90bqbptypq.queiries.su
1ump7r1lgu.eevootii.su
xfa20zd8g.thepohzi.su
u3khsfx5t.eevootii.su
opscko50n.queiries.su
mpgazwtql.queiries.su
i2j7ody3l.queiries.su
hw0nvgw9g.queiries.su
hh2m2woyq.eevootii.su
fke3n36o7.eevootii.su
fceub4opn.queiries.su
eimzgzufm.queiries.su
co5ccmqu4.eevootii.su
c6n2wnnk7f.wahemah.cc
bz5oms2mk.eevootii.su
bxveasc7x.thepohzi.su
7uv130zdq.queiries.su
6mp82hlaz.eevootii.su
6f0j45bwd.eevootii.su
3jyfft94k.thepohzi.su
v82x6g7h.queiries.su
rnv5wo9l.thepohzi.su
opw1vxxr.thepohzi.su
o5dj2y1w.queiries.su
nbp772fj.thepohzi.su
mhptctpo.thepohzi.su
i8jsebv7.eevootii.su
hjddxc46.eevootii.su
dtl3spto.queiries.su
d0hnnq83.eevootii.su
4nqe6k50ig.oogagh.su
1o5q1f56.eevootii.su
0xb31hx1.eevootii.su
0uwk8loqn.tohk5ja.cc
0pxstfi9.eevootii.su
z6gvyt7.thepohzi.su
xv5c8z9.thepohzi.su
xa6eiwi.thepohzi.su
wdpllzj.eevootii.su
wbucv18.queiries.su
veoolji.queiries.su
qwb7aec2.wahemah.cc
lsysfzz.eevootii.su
l7x4wyb.queiries.su
he2z28g.queiries.su
gj5hzjm.eevootii.su
6oxlsw1.eevootii.su
6m6vzgo.thepohzi.su
4786htb.queiries.su
3hq0trn.queiries.su
3hk0jqe.eevootii.su
29bcrwd.queiries.su
y9l4xc.queiries.su
xy78z4f.tohk5ja.cc
txwyt8.thepohzi.su
sqmdo8.queiries.su
owu68i.queiries.su
l.dvvl.freedns.biz
j.yacl.freedns.biz
h.gwkf.freedns.biz
h5nutv.queiries.su
g.dtdl.freedns.biz
f9zhmn.queiries.su
4w64s8.queiries.su
4fvd94.eevootii.su
j.eff.freedns.biz
73u0sqz.oogagh.su
hnbg1.wahemah.cc

END