PegasHosting range null-routed

After seeing an article by Conrad over at dynamoo.com, I decided to get in touch with my contact at NetDirekt (cheers Frank!), and am happy to report, PegasHosting have now had one of their ranges null-routed.

http://blog.dynamoo.com/2010/07/evil-network-pegashosting-network.html

PegasHosting (178.162.135.0 - 178.162.135.255), an "ISP" based out of the Ukraine, have had a history of being 100% malicious for as long as I can remember, hosting and previously hosting (some have moved, others no longer resolve), such lovely's as;

4aclepsa.com
Adjustedresults.com
Allhdmovies.com
Alternativedabell.com
Alternativedago.com
Alternativedasound.com
Alternativedassound.com
Alternativedasting.com
Arbeit-vitrea.com
Avalonassistants.com
Beachamateursite.info
Best-freemovie.com
best-freemovie.com
Best-freemovies.com
best-freemovies.com
Bettertasks.com
Big-stan.ru
Bongblogs.net
Bonglove.net
Bonus-file.net
Cadipll.com
Careers-at-lexor.com
Careers-at-stendal.com
Careers-at-vitrea.com
Careers-kivox.com
Careers-stendal.com
Careers-tekset.com
Dasoundservices.com
Datingprivates.com
Datingteen.net
datingteen.net
Datingteenonline.net
Datingwork.com
Deutschenoote.com
Dragporno.ru
Ebaysquaretrade.com
Escrow-ento.com
Es-trabajowug.com
Europe-stendal.com
Freemoviebest.com
freemoviebest.com
Free-moviebest.com
free-moviebest.com
Fremoviesbest.com
fremoviesbest.com
Gamestaff.org
Gl-transport.com
Gpssystemsused.com
Hallway-careers.com
Hallway-group-careers.com
Hallway-group-jobs.com
Hallway-jobs.com
Hallway-news.com
Hallway-today.com
Hat.am
Hiring-westunion.com
Hotlatinotube.info
Hotnudistmix.info
Immobilie-vitrea.com
Intelligentlogistics.biz
Jacksonstatue.com
Jobs-at-hallway-group.com
Jobs-at-lexor.com
Jobs-at-stendal.com
Jobs-at-stendalgroup.com
Jobs-kivox.com
Jobs-lexor.com
Jobs-stendal.com
Jobs-tekset.com
kanal911.com
Karrieren-immobilie-vitrea.com
Karrieren-vitrea.com
Kernet.name
Kivox-careers.com
Kivox-company.com
Kivox-consulting.com
Kivox-jobs.com
Kivox-today.com
Kptarnews.com
Kydesniki.net
Lexor-careers.com
Lexor-consulting.com
Lexor-jobs.com
Lexorsl.com
Lexor-sl.com
Lexor-sl-careers.com
Lexor-sl-consulting.com
Love4net.net
Mailcenter-yahoo.com
Mangomeds.net
Mangomeds.org
Mayki.in
Mcashjdg.com
Medisupprt.com
Medswhite.com
Megaru.com
Mejdskas.com
Mhasdhfg.com
Mksdjhfu.com
Mlhsgdhh.com
Moviebest-free.com
moviebest-free.com
Moviefree-best.com
moviefree-best.com
Moviesbest-free.com
moviesbest-free.com
Moviesfree-best.com
moviesfree-best.com
Mp3gigant.net
Msk-guvd.org
Myalternativedating.com
Myasjhaa.com
Mybisiness.org
Mypsp.my
Naebalova.net
Nafani.net
Neomaks.ru
neomaks.ru
News-stendal.com
N-transport.com
Office-exchange.biz
Office-exchange.info
Onlinerentalparadise.com
Ourmeds.org
Partyhotpregnant.info
Pootervom.com
Pop-banner.ru
Pornogandon.ru
Qctsupport.com
Qzzb.ru
Redheadvideovideos.info
Releaseadultsex.com
Releaseating.com
Resultscache.com
Romlife.net
seriall.com
Shop-n-ship.net
Silentspy.ru
Siteblondhot.info
Sms-partner.net
Softcracks.com
Sportsbear.net
Stendal-applications.com
Stendalcareers.com
Stendal-careers-now.com
Stendal-careers-today.com
Stendal-consulting.com
Stendal-consulting-group.com
Stendaljobs.com
Stendal-news.com
Stendaltoday.com
Stendal-today.com
Tdsse.net
Tekset-careers.com
Tekset-consulting.com
Tekset-jobs.com
Tekset-news.com
Thefreedating.com
Todaysnewest.com
Trilanecareers.com
Trilane-careers.com
Trilaneconsulting.com
Trilane-consulting.com
Trilane-jobs.com
Tubegirlsexy.info
Tuberedheadnudist.info
Tuberedheadsexy.info
Videobum.net
Vitrea-arbeit.com
Vitrea-deutchland.eu
Vitrea-estate.eu
Vitrea-estate-agents.com
Vitreaestatecareers.com
Vitreaestate-europe.com
Vitrea-immobilie.com
Vitrea-immobilie-karrieren.com
Vitreajobs.com
Vitrea-karrieren.com
Vitreanews.com
Vitrea-today.com
Vitrea-uk.com
Watchporno.ru
Webalternativedating.com
Webfreeadultsexnet.com
Westunionhiring.com
Wetlesbianstube.info
Wmmailz.com
Work-at-duolux.com
Work-at-tekset.com
Wr-mail.ru
Xandgo.net
Xlivetv.ru
xlusiv.net
X-torrents.info
X-torrents.name
X-torrents.net
X-torrents.nu
X-torrents.org
X-torrents.ru
Yastreb.biz

WhoIs for PegasHosting.com, given they don't want their contact details on their site for some reason, is;

Domain Name: PEGASHOSTING.COM

Creation Date: 01-Feb-2010
Modification Date: 01-Feb-2010
Expiration Date: 01-Feb-2011

Domain servers in listed order:
ns1.pegashosting.com
ns2.pegashosting.com

Registrant:
Staricin Maxim abuse@pegashosting.com
PegasHosting.com
6/40 Mira str.
Kiev, 03134
UKRAINE
+380.994005332

Billing Contact:
Staricin Maxim abuse@pegashosting.com
Private person
6/40 Mira str.
Kiev, 03134
UKRAINE
+380.994005332

Administrative Contact:
Staricin Maxim abuse@pegashosting.com
PegasHosting.com
6/40 Mira str.
Kiev, 03134
UKRAINE
+380.994005332

Technical Contact:
Staricin Maxim abuse@pegashosting.com
PegasHosting.com
6/40 Mira str.
Kiev, 03134
UKRAINE
+380.994005332

Status: ok

Could've sworn I'd had these guys null routed before, and will be continuing to monitor them to see where they go to next, as it's guaranteed they'll choose a less than ethical upstream this time round, to make it harder for me to get them null routed again.

Special thanks to Conrad (been following his blog for a considerable amount of time now, and it's highly recommended reading if it's not on your follow-list yet) for his post, as it saved me alot of time, and special thanks to Frank for nuking them so quickly.

Important

It's important to note, although only one range is mentioned here, PegasHosting actually have several of them (77.120.109.0/24 via AS25229 (VOLIA-AS Kyivski Telekomunikatsiyni Merezhi LLC, upstream provider is GlobalCrossing) [Robtex] and 124.217.254.0/24 via AS45839 [Robtex] (PIRADIUS-AS PIRADIUS NET AS45839, a known crimeware friendly ISP [ 1, 2, 3 ]), and yes, I'm working on getting those nuked as well.

/update 23:40 13-07-2010

I am happy to report, BurstNet/HostNoc, have nuked both ns1.pegashosting.com and ns2.pegashosting.com, previously at 64.191.87.198. As of a few seconds ago, neither are resolving, nor is ns1.pegas-host.org. Though PegasHosting still have their other name servers of course, such as ns1.pegas-dns.org, ns2.pegas-host.org, both of which are also housed on 178.162.158.0/24, which is a NetDirekt range (178.162.158.11 and 178.162.158.12 respectively. NetDirekt were sent a take down request for these this morning.