These domains were registered last week but the scripts have only now been uploaded. This seems like suspicious behavior to me…
- hxxp://marqatha[.]com
- hxxp://marqrdha[.]com
- hxxp://vaiqsant[.]com
- hxxp://vaiqbant[.]com
- hxxp://mawqreha[.]com
- hxxp://vazxant[.]com
- hxxp://marqrxha[.]com
- hxxp://marqreha[.]com