This IP has hosted other domains used by APT3 in past campaigns:  DOMAIN  FIRST SEEN  LAST SEEN  IP ADDRESS  join.playboysplus[.]com  2014-11-21  2014-11-21  104.151.248.173  walterclean[.]com  2014-11-18  2014-11-20  104.151.248.173  www.walterclean[.]com  2014-11-18  2014-11-20  104.151.248.173   As we discussed in our previous blog detailing previous APT3 activity, the walterclean[.]com served as a Plugx/Kaba command and control server