I was a little curious as to why I kept coming across Jolly Works Hosting from the Philippines when it came to malware hosting. They are a customer of Secured Servers LLC in the US, and when I took a close look at malware reports with Secured Servers IPs addresses it turns out that most of them were actually suballocated to Jolly Works Hosting instead.
Jolly Works has a real website and real customers, but not all of those customers are very desirable. In particular, these following IP addresses are current hotbeds of malware and are definitely worthy of blocking:
108.170.46.130
184.95.37.100
184.95.37.109
184.95.51.123
184.164.136.150
I have enumerated much of their network for research purposes and uploaded it here [csv]. The file contains the domain, IP, decimalised IP, WOT ratings, Google Prognosis and SURBL status. Do with it what you will.
As far as I can tell, these following Secured Servers IP ranges are suballocated to Jolly Works Hosting. There are some real legitimate websites in there, but if you wanted to do some sort of filtering or scoring with them then the ranges are:
66.85.153.160/27
108.170.6.16/28
108.170.7.160/28
108.170.13.192/27
108.170.29.128/27
108.170.46.128/29
174.138.163.176/28
174.138.172.48/28
184.95.37.96/28
184.95.37.144/28
184.95.38.32/29
184.95.51.112/28
184.95.54.208/28
184.164.136.80/28
184.164.136.128/27
184.164.141.32/27
184.164.147.128/27
184.164.151.32/27
184.171.167.192/28
209.188.0.96/27
No comments:
Post a Comment