All IP reputation systems (and related filtering too for that matter) will tend to group similar things together under that assumption that if a number of them are definitely bad the rest probably are too. This isn't perfect but it generally works, as long as the system pays careful attention to corner cases to exclude any false positives.
Over the last couple of days there have been a couple of examples of this - one good, one bad. The bad one is a false positive that occurred on the Russian Business Network feed in which a perfectly harmless company was swept up in the suspicion that it was as bad as its neighbors. The problem in this case was that a quick look showed that it had some features similar to a malware site (multiple subdomains and sub-subdomains on the same host) and was in the same /24 subnet as a number of hosts that were indeed malware sites. Hence the RBN researchers decided to add the entire /24 subnet to their list.
In this case the benefit that ThreatSTOP provides of proactive whitelisting meant that when one of our customers complained, we could quickly add the affected hosts to our whitelist so that they were no longer blocked for our subscribers. And, subject to periodic checks to conform their goodness, they will remain that way so that if other analysts also decide to block the same /24 we will continue to carve out their addresses.
The other example is a minor issue that befell Sony Thailand. As if Sony didn't have enough to worry about, it seems that one of Sony Thailand's servers was infiltrated with malware and became a phishing site masquerading as an Italian bank. Now the interesting thing here (from an IP reputation standpoint) is that while www.sony.co.th and many other sony domains are hosted on Akamai's global network, the host in question (hdworld.sony.co.th) turns out to be hosted on by Thai ISP at 220.127.116.11. A quick check on the ISC's passive DNS database shows that this address is used by a number of Sony and non-Sony related sites as well:
3d.sony.co.th. A 18.104.22.168
bloggie.sony.co.th. A 22.214.171.124
bpex2009.sony.co.th. A 126.96.36.199
bravia.sony.co.th. A 188.8.131.52
dexdev.com. A 184.108.40.206
diwmap.zg-zing.com. A 220.127.116.11
dslr.sony.co.th. A 18.104.22.168
feelmorepower.com. A 22.214.171.124
handycam.sony.co.th. A 126.96.36.199
hdworld.sony.co.th. A 188.8.131.52
icrecorder.sony.co.th. A 184.108.40.206
mail.nabaan.com. A 220.127.116.11
ns3.readyspaces.net. A 18.104.22.168
ns4.readyspaces.net. A 22.214.171.124
salt.sony.co.th. A 126.96.36.199
sframe.sony.co.th. A 188.8.131.52
vaio.sony.co.th. A 184.108.40.206
walkman.sony.co.th. A 220.127.116.11
www.dexdev.com. A 18.104.22.168
www.nabaan.com. A 22.214.171.124
www.pantenestarsearch.com. A 126.96.36.199
www.zg-zing.com. A 188.8.131.52
youngcreative.sony.co.th. A 184.108.40.206
I strongly suspect that in this case proximity led to the infection. That is to say that one of the other virtual hosts on the same server was compromised and then the attackers infected some or all of the other vhosts, including in this case one of Sony's. Ooops. And a great example of why IP reputation works. Ir really is likely that infections and malware spread to otherwise innocent bystanders.