Dynamoo's Blog

192.95.44.0/27 (spotted by Frank Denis ) is another evil OVH Canada netblock which I assume belongs to their black hat customer r5x.org /...

I've covered OVH Canada and their black hat customer r5x.org aka "Penziatki" before. They consistently host exploit kits, ...

I've been a bit tardy with this look at the new OVH Canada ranges exposed by Frank Denis so some of these domains may already been d...

Another useful tip by Frank Denis on evil in the OVH Canada IP ranges, suballocated to their black hat customer " r5x.org / Penziat...

Thanks again to Frank Denis (@jedisct1) for this heads up involving grubby web host OVH Canada and their black hat customer " r5x...

Note: a more up-to-date list can be found here . Hat tip to Frank Denis (@jedisct1) for this report on Nuclear EK's hosted by OVH ...

Another OVH Canada range hosting criminal activity, 192.95.7.224/28 is being used for several malicious .pw domains being used to distrib...

192.95.10.208/28 (OVH, Canada) is being used to deliver exploit kits utlising .pw domains, for an example see this URLquery report .  The...

Russian web host R5X.org has featured on this blog a few times before , but I took the opportunity to look at it a little more closely. Wh...

These malicious sites and IPs are related to this attack (thanks to the folks at ThreatTrack Security for the tip). Although a lot of th...

Here are a couple of IPs serving exploit kits.. the case in question is a legitimate site that loads code from 6rf.net and this in turn ...

The IP address range 178.63.195.128/26 nominally belongs to grey hat host Hetzner in Germany, although it has been reallocated to a regist...