Tainted network: Dmitry Shestakov / vds24.net on OVH

vds24.net (apparently belonging to "Dmitry Shestakov ") is a Russian reseller of OVH servers that has come up on my radar a few times in the past few days [1] [2] [3] in connection with domains supporting Teslacrypt malware and acting as landing pages for the Angler exploit kit.

Curious as to what was hosted on the vds24.net I set about trying to find out their IP address ranges. This proved to be somewhat difficult as they are spread in little chunks throughout OVH's IP space. I managed to identify:

5.135.58.216/29
5.135.254.224/29
51.254.10.128/29
51.254.162.80/30
51.255.131.64/30
149.202.234.116/30
149.202.234.144/30
149.202.234.188/30
149.202.237.68/30
176.31.24.28/30
178.32.95.152/29
178.33.200.128/26

Then using a reverse DNS function, I looked up all the domains associated with those ranges (there were a LOT) and then looked the see which were active plus their SURBL and Google ratings. You can see the results of the analysis here [csv].

There may well be legitimate domains in this range, but out of 1658 domains identified, 1287 (77.6%) are flagged by SURBL as being spammy. Only 11 (0.7%) are identified as malicious, but in reality I believe this to be much higher.

In particular, the following IP ranges seem to be clearly bad from those ratings:

51.254.10.131
51.254.162.81
51.255.131.66
51.255.142.101
149.202.234.190
149.202.237.68
178.33.200.138

I can see 61 active IPs in the vds24.net range, so perhaps it is only a small proportion. However, depending on your network stance, you may want to consider blocking all the IP ranges specified above just to be on the safe side.

UPDATE

One additional range has come to light, connected with the Dridex banking trojan:

51.254.51.176/30