Stumbled upon IP here: http://www.shodanhq.com/search?q=shellshock
Yes, Shodan is also a great search resource for security folks, my good avast friends, ;D
So then we landed here: https://www.virustotal.com/nl/ip-address/173.193.31.2/information/
See what that AS has in store for us: http://sitevet.com/db/asn/AS36351
So Softlayer Abuse may be deaf from one ear ;D ;).
And off-course some there wanted to proof their domain is above board: http://173.193.31.2/ = http://retalix.com.trustcheck.net/ Trustcheck is always a nice badge for folks that go around with 'tinker bells",
to say “Look what good guys we really are - trustcheck proofs it!”.
Yes, that domain is above board - but the domain with shellshock is not:
https://www.mywot.com/en/scorecard/starkmedia.com?utm_source=addon&utm_content=popup
Re: http://spamvertised.abusebutler.com/
pol