Something evil on 178.211.33.203 and 109.236.80.151

178.211.33.203 and 109.236.80.151 are a pair of IP addresses distributing some sort of malware in a coordinated attack. They seem to be part of the same attack. The malware itself is still pending analysis, but you might want to block these URLs and/or IPs.

Incidentally, the domains seem legitimate GoDaddy-registered ones, but I am guessing they have been hacked to serve up malware on their *.domainname.com subdomains.

178.211.33.203
*.extensionbay.com
*.kingoftheaquarium.com
*.vicandbarbs.net
*.dancesearcy.com
*.learn2drive4free.com
34107.vicandbarbs.net
30659.vicandbarbs.net
8918.vicandbarbs.net
28980.majesticbetta.com
52734.majesticbetta.com
37926.majesticbetta.com
39168.majesticbetta.com
5139.majesticbetta.com
2673.learn2drive4free.com
51226.kingoftheaquarium.com
59038.kingoftheaquarium.com
29878.kingoftheaquarium.com
50588.kingoftheaquarium.com
24898.dancesearcy.com

109.236.80.151
*.bankingonbankers.com
*.bankdirectoryonline.com
*.californiagoldbook.com
*.ch.redirect.2350283972.bankingonbankers.com
*.google.ch.redirect.2350283972.bankingonbankers.com
*.redirect.2350283972.bankingonbankers.com
2350283972.bankingonbankers.com
31337.bankingonbankers.com
ch.redirect.2350283972.bankingonbankers.com
google.ch.redirect.2350283972.bankingonbankers.com
redirect.2350283972.bankingonbankers.com
www.google.ch.redirect.2350283972.bankingonbankers.com
*.2350283972.bankingonbankers.com
int.ask.com.redirect.384569840.bankdirectoryonline.com
www.google.de.redirect.312464722.bankdirectoryonline.com
www.google.de.query.11111533.bankdirectoryonline.com
www.lr-aloevera.at.search.1639590514.bankdirectoryonline.com
www.google.de.query.39586074.bankdirectoryonline.com
www.surftipp.de.query.320136795.bankdirectoryonline.com
suche.aol.de.query.469388806.bankdirectoryonline.com
www.google.at.redirect.512545616.bankdirectoryonline.com
www.google.de.redirect.3379156420.californiagoldbook.com
www.google.de.search.3333773661.californiagoldbook.com
www.google.de.query.3386209042.californiagoldbook.com
www.google.de.query.3261224572.californiagoldbook.com
www.google.com.tr.search.274580395.californiagoldbook.com
www.google.de.search.342911457.californiagoldbook.com
www.google.com.query.417110658.californiagoldbook.com
www.google.ca.process.983249139.californiagoldbook.com
www.google.de.search.310514469.californiagoldbook.com
www.google.de.redirect.417610242.bankingonbankers.com
www.google.at.url.427019192.bankingonbankers.com
www.google.de.query.3262094134.bankingonbankers.com
www.google.fr.redirect.579034634.bankingonbankers.com
www.google.de.query.3334101725.bankingonbankers.com
www.google.de.url.524065725.bankingonbankers.com
www.google.de.url.341584535.bankingonbankers.com
www.ferienwohnung-hotels-kroatien.de.query.451051745.bankingonbankers.com
www.google.com.br.query.4120413008.bankingonbankers.com
www.google.de.process.277767529.bankingonbankers.com