That fake DNS trojan we blogged about earlier points to an IP range starting with 85.255. You can see what it’s been doing here. Earlier this month, SpamHaus put it on their block list (here). You can see all kinds of familiar names there — Intercage, Inhoster, Pilosoft, the usual.
Ugly.
Alex Eckelberry
(Thanks Adam)