Netcraft claim these URLs are malware infrastructure