Malicious Hosts Investigation

[DNSBunker]

Concern/Question

Hey @hagezi and @MikhailKasimov

I need help with two IPs from CZ which are bond to a huge amount of malicious domains.

Much appreciated if you can extract and include those domains to your designated IOCs/Lists.

185[.]115[.]167[.]111
34[.]80[.]213[.]13

Sincerely,
xRuffKez

Terms

• I confirm that the request does not contain any sexually explicit material or private/sensitive information.
• I confirm that the request does not contain any clickable links to malware, phishing, scams, or similar malicious content. Any potentially harmful URLs have been deliberately masked (e.g., by replacing “.” with “[.]”) to prevent accidental access. I have reviewed all included links and taken appropriate precautions to ensure user safety.

[github-actions]

Thank you for your support. Ping @MikhailKasimov for checking and possibly including the domain(s).

[hagezi]

@DNSBunker
https://bgp.he.net/net/185.115.167.111/32#_dnsrecords
https://bgp.he.net/net/34.80.213.13/32#_dnsrecords

[DNSBunker]

@hagezi so i hit a wasp nest lol
Safe to block those domains?

[hagezi]

They all seem to be gambling domains.

[MikhailKasimov]

OK, would do today later