FLV file is an interesting choice of decoy document since it is not a standard video format for media players. The dynamic DNS domains windowsupdate.noip[.]biz and masalavideos.no-ip[.]biz were also being mapped to IP Address 199.91.173.43 as of late May 2013, when the video themed malicious attachments