Known infection source on DROWn exploitable nameserver!

Webzilla abuse: Up(nil): ARIN US root at -dfw.net -206.54.160.102 to -88.85.84.192 be-24.ru -http://0348f098c9.be-24.ru/
Re: https://www.virustotal.com/en-gb/url/9dc576856a4659e8b069a415f9b643463ae2f85705772db1358d1c5d2c252be9/analysis/1469379652/
Found clean: https://quttera.com/detailed_report/0348f098c9.be-24.ru & https://sitecheck.sucuri.net/results/0348f098c9.be-24.ru
and https://urlquery.net/report.php?id=1469378924392 See: http://toolbar.netcraft.com/site_report?url=0348f098c9.be-24.ru
Nameserver: DROWn exploitable: https://test.drownattack.com/?site=ns1.reg.ru
Re: https://aw-snap.info/file-viewer/?tgt=http%3A%2F%2F0348f098c9.be-24.ru&ref_sel=GSP2&ua_sel=ff&fs=1
going to known malware IP: 206.54.160.102 on blocklist-ip set

polonus