I propose 94.63.241.155 for blocklist

[Seedler]

94.63.241.155 appears to be associated with CryptMEN:

The Host header on the request was the IP and this was in the response:

Content-Disposition: attachment; filename="inst.exe"

94.63.241.151 is already on the AMaDa blocklist (http://amada.abuse.ch/blocklist.php?download=ipblocklist) and it is in the same netblock (which is registered to a RO address....).

-Seedler

[SysAdMini]

94.63.241.155 appears to be associated with CryptMEN:

The Host header on the request was the IP and this was in the response:

Content-Disposition: attachment; filename="inst.exe"

94.63.241.151 is already on the AMaDa blocklist (http://amada.abuse.ch/blocklist.php?download=ipblocklist) and it is in the same netblock (which is registered to a RO address....).

-Seedler

If you can provide complete urls of currently active malware then I will add them to our database.