Hi Pondus,

Beaten me by a sec. Funny that abuse.ch Zeus tracker did not have that domain.
Cybercriminal IPs and sites are often missed by the “run of the mill” scanners, IDS gets them, even Sucuri and see: http://zulu.zscaler.com/submission/show/dcf8f4390531ec8089228dfeac17069b-1392909153 (it is a shame really)
also read this: http://comments.gmane.org/gmane.network.dns.operations/577
and our friend gmane certainly has a point there. Why they need 34 nameservers with multiple IP addresses? ???

pol