Evil Network: AS48691 (194.28.112.0/22)
Evidence:
- http://isc.sans.edu/diary.html?storyid=12304
- http://blog.dynamoo.com/2011/12/evil-network-revisited-specialist-ltd.html
From Dynamoo‘s Blog:
“but there is still not a legitimate site in sight. Most of the bad sites are currently on 194.28.114.102 but you should block access to 194.28.112.0/22 (194.28.112.0 - 194.28.115.255) if you can, because this range of IP addresses is nothing but trouble.”