So read this article over at Kapersky by Vitaly. Apparently there’s a guy who’s providing A/V tracking info for malware developers so that they can include blacklisted (bad for the malware) IP addresses in their code.
http://www.viruslist.com/en/weblog?weblogid=208187881
Apparently he’s upset with the A/V companies, ‘specially Kaperski at the moment.
The link to the site in question is in the article. Visit at your own risk.