Historical and actual threat from IP, should be blocked!

Viruses and worms
1

No alerts here: http://urlquery.net/report.php?id=9436356
but see Recent reports on same IP/ASN/Domain
Last 5 reports on IP: 31.170.165.176 there.
This list is not encouraging: http://sameid.net/ip/31.170.165.176/
neither is this: https://www.virustotal.com/nl/ip-address/31.170.165.176/information/
Detection is questionable: https://www.virustotal.com/nl/url/aad558716ac9183472a9a926d49061a179de12475a73b8f4df6c0478aeeab755/analysis/
and https://www.virustotal.com/nl/file/805ded68d6d6425efc2e166261ca894f907cfcf47521549d71670528b4ae2546/analysis/1388479253/
and for our example: https://www.virustotal.com/nl/url/1b8e9be831f368f863c41c1bfe79b8bacbd5df43a00162b53fd26f639f98e497/analysis/
iBanking type of CyberCrime. RBN IP last seen 5 months ago (zz dot mu phishing) → https://www.mywot.com/en/scorecard/smsgrabber.url.ph
Here we find all the details: http://sitecheck.sucuri.net/scanner/?scan=http%3A%2F%2Fsmsgrabber.url.ph%2Fandroid%2Fadmin.php
malcode down - going to htxp://www.hostinger.ru/prevushenie_resursov_processora?smsgrabber.url.ph -
also read for historical and more recent issues: http://www.000webhost.com/forum/customer-assistance/31685-000webhost-hostinger-ru.html
posters Clyde and d3iti etc.

polonus

2

It is now redirecting here: http://www.webutations.net/go/review/redirect.main-hosting.eu?req=chrome
We are being informed here to better not visit site: http://scanurl.net/?u=redirect.main-hosting.eu&uesb=Check+This+URL#results
See: http://support.clean-mx.de/clean-mx/viruses?id=12084089 and avast! will detect this for us: https://www.virustotal.com/nl/file/abba7a70b7653adcf2ddfc9f2ec965ee675bfba2242c80963d09f1a728fbb08f/analysis/
See: http://urlquery.net/report.php?id=8769121
No alert for this: http://urlquery.net/report.php?id=9227676 → https://www.mywot.com/en/scorecard/redirect.main-hosting.eu?utm_source=addon&utm_content=rw-viewsc → http://fetch.scritch.org/%2Bfetch/?url=http%3A%2F%2Fredirect.main-hosting.eu%2F&useragent=Fetch+useragent&accept_encoding=

pol

3

Dear IP scanning friends,

This IP was logged at http://log.matapala.org/
Checked at ThreatSTOP see attached.
Data from Russian badips.com → http://www.badips.com/info/5.153.51.52
Extensive report here: http://www.blocklist.de/en/view.html?ip=5.153.51.52
See: htxp://atma.es/deny.txt ( link is being blacklisted by Bitdefender’s TrafficLight as malicious!?!)
Listed here trying to break in: http://www.eons.de/breakins/
Listed here: http://logv1.nine.ch/hosts.deny
Listed here: http://www.us.openbl.org/lists/base.txt
Listed here: http://www.vase.stranka.cz/brutes/blocked.txt

Certainly worth blocking,

polonus