In reply to Vijay Sarvepalli.

Hi Vijay,

Thanks for your question. Please allow me to clarify. The IoCs from these attacks included domains from both changeip.com and domains we believe the attackers registered themselves.

In this particular case the domain names zyns.com, ddns.name, and epac.to are all domains available for free third-level subdomain registration by changeip.com. They are listed as IoCs in the analysis by Rapid7. A full list of the second-level domains available at changeip.com can be found here: http://www.changeip.com/freedomains.asp

The phmail.us and phdns01.com domains were different because these domains were both registered back in 2009 using similar fraudulent WHOIS registration data. We believe the attackers registered and controlled these domains themselves, and this makes the patterns we see in the passive DNS data both relevant and interesting. The pattern of the DNS server returning 127.0.0.1 much of the time and only returning routable IPs for small durations was consistent with other subdomains we investigated as well.

Hope this helps,
Jaeson