OVH Canada ranges exposed by Frank Denis so some of these domains may already been dead.
Yesterday Frank identified three new OVH Canada ranges being used to host the Nuclear EK, again the customer is "r5x.org / Penziatki"
Update: also 18.104.22.168/30 according to this Tweet.
A full list of everything I can find is here [pastebin] but the abused domains that I have identified are:
At a mininum I recommend that you block those IP ranges and/or domains.
Given the extremely poor reputation of these OVH Canada ranges, I would
suggest blocking the following network ranges if you have a
security-sensitive environment and are prepared to put up with the
collateral damage of blocking some legitimate sites: