December 2020 - Location - lists.ipfire.org

[PATCH] location-importer.in: skip networks with unknown country codes
by Peter Müller 04 Feb '21

04 Feb '21

There is no sense in parsing and storting networks whose country codes cannot be found in the ISO-3166-x country code table. This avoids side effects in applications using the location database, and introduces another sanity check to compensate bogus RIR data. On location02, this affects some networks from APNIC (country code: ZZ) as well as a bunch of smaller allocations within the RIPE region still tagged to CS or YU (Yugoslavia). To my surprise, no network tagged as SU (Soviet Union) was found - while the NIC for .su TLD is still operational. :-) Fixes: #12510 Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- src/python/location-importer.in | 42 ++++++++++++++++++++++----------- 1 file changed, 28 insertions(+), 14 deletions(-) diff --git a/src/python/location-importer.in b/src/python/location-importer.in index 864eab1..89b556a 100644 --- a/src/python/location-importer.in +++ b/src/python/location-importer.in @@ -388,10 +388,17 @@ class CLI(object): TRUNCATE TABLE networks; """) + # Fetch all valid country codes to check parsed networks aganist... + rows = self.db.query("SELECT * FROM countries ORDER BY country_code") + validcountries = [] + + for row in rows: + validcountries.append(row.country_code) + for source in location.importer.WHOIS_SOURCES: with downloader.request(source, return_blocks=True) as f: for block in f: - self._parse_block(block) + self._parse_block(block, validcountries) # Process all parsed networks from every RIR we happen to have access to, # insert the largest network chunks into the networks table immediately... @@ -467,7 +474,7 @@ class CLI(object): # Download data with downloader.request(source) as f: for line in f: - self._parse_line(line) + self._parse_line(line, validcountries) def _check_parsed_network(self, network): """ @@ -532,7 +539,7 @@ class CLI(object): # be suitable for libloc consumption... return True - def _parse_block(self, block): + def _parse_block(self, block, validcountries = None): # Get first line to find out what type of block this is line = block[0] @@ -542,7 +549,7 @@ class CLI(object): # inetnum if line.startswith("inet6num:") or line.startswith("inetnum:"): - return self._parse_inetnum_block(block) + return self._parse_inetnum_block(block, validcountries) # organisation elif line.startswith("organisation:"): @@ -573,7 +580,7 @@ class CLI(object): autnum.get("asn"), autnum.get("org"), ) - def _parse_inetnum_block(self, block): + def _parse_inetnum_block(self, block, validcountries = None): log.debug("Parsing inetnum block:") inetnum = {} @@ -624,17 +631,17 @@ class CLI(object): if not inetnum or not "country" in inetnum: return - # Skip objects with bogus country code 'ZZ' - if inetnum.get("country") == "ZZ": - log.warning("Skipping network with bogus country 'ZZ': %s" % \ - (inetnum.get("inet6num") or inetnum.get("inetnum"))) - return - network = ipaddress.ip_network(inetnum.get("inet6num") or inetnum.get("inetnum"), strict=False) if not self._check_parsed_network(network): return + # Skip objects with unknown country codes + if validcountries and inetnum.get("country") not in validcountries: + log.warning("Skipping network with bogus country '%s': %s" % \ + (inetnum.get("country"), inetnum.get("inet6num") or inetnum.get("inetnum"))) + return + self.db.execute("INSERT INTO _rirdata(network, country) \ VALUES(%s, %s) ON CONFLICT (network) DO UPDATE SET country = excluded.country", "%s" % network, inetnum.get("country"), @@ -659,7 +666,7 @@ class CLI(object): org.get("organisation"), org.get("org-name"), ) - def _parse_line(self, line): + def _parse_line(self, line, validcountries = None): # Skip version line if line.startswith("2"): return @@ -674,8 +681,15 @@ class CLI(object): log.warning("Could not parse line: %s" % line) return - # Skip any lines that are for stats only - if country_code == "*": + # Skip any lines that are for stats only or do not have a country + # code at all (avoids log spam below) + if not country_code or country_code == '*': + return + + # Skip objects with unknown country codes + if validcountries and country_code not in validcountries: + log.warning("Skipping line with bogus country '%s': %s" % \ + (country_code, line)) return if type in ("ipv6", "ipv4"): -- 2.20.1

1 2

[PATCH] overrides-{a3,other}: regular batch of overrides
by Peter Müller 07 Jan '21

07 Jan '21

This time, we primarily correct locataion data for "Datashield, Inc." networks... Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- overrides/override-a3.txt | 5 +++++ overrides/override-other.txt | 30 ++++++++++++++++++++++++++++++ 2 files changed, 35 insertions(+) diff --git a/overrides/override-a3.txt b/overrides/override-a3.txt index 1112e6d..381ffbe 100644 --- a/overrides/override-a3.txt +++ b/overrides/override-a3.txt @@ -1557,6 +1557,11 @@ descr: xTom / dns.sb remarks: Public anycast DNS resolver is-anycast: yes +net: 2a04:ff00:402::/48 +descr: Zeimudo Networks +remarks: Generic anycast network +is-anycast: yes + net: 2a0c:3800:ff::/48 descr: Jean-Remy Buchs remarks: Generic anycast network diff --git a/overrides/override-other.txt b/overrides/override-other.txt index ef1e779..1bd3c2a 100644 --- a/overrides/override-other.txt +++ b/overrides/override-other.txt @@ -143,6 +143,11 @@ descr: FiberXpress BV remarks: bulletproof ISP (related to AS202425) located in NL country: NL +aut-num: AS58073 +descr: YISP BV +remarks: ISP located in NL, but some RIR data for announced prefixes contain garbage +country: NL + aut-num: AS58271 descr: FOP Gubina Lubov Petrivna remarks: bulletproof ISP operating from a war zone in eastern UA @@ -183,6 +188,11 @@ descr: Wujidun Network Limited remarks: part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to AP region country: AP +aut-num: AS200699 +descr: Datashield, Inc. +remarks: fake offshore location (SC), traces back to NL +country: NL + aut-num: AS200845 descr: AVATEL TELECOM remarks: ISP located in ES, but some RIR data for announced prefixes contain garbage @@ -233,6 +243,11 @@ descr: Alviva Holding Limited remarks: bulletproof ISP operating from a war zone in eastern UA country: UA +aut-num: AS209401 +descr: Gudaev Maxim Amrakhovich +remarks: announcements scatter across various places in EU (DE/CZ/??), but RIR data contain garbage +country: EU + aut-num: AS213058 descr: Private Internet Hosting LTD remarks: bulletproof ISP located in RU @@ -303,6 +318,11 @@ descr: IPv4 Superhub Limited remarks: network owned by an HK company, traces back to HK as well - but is assigned to DE. Nice try... country: HK +net: 45.134.12.0/24 +descr: MS Network LTD +remarks: fake offshore location (SC), traces back to NLm +country: NL + net: 45.134.144.0/22 descr: IPv4 Superhub Limited remarks: same as 45.93.16.0/22 @@ -358,6 +378,11 @@ descr: FlokiNET Ltd. remarks: fake offshore location (SC), traces back to RO country: RO +net: 185.56.80.0/22 +descr: Datashield, Inc. +remarks: fake offshore location (SC), traces back to NL +country: NL + net: 185.140.204.0/22 descr: Hornetsecurity GmbH remarks: all suballocations are used in DE, but are assigned to US @@ -437,3 +462,8 @@ net: 2a05:9f06::/31 descr: Sibyl System LTD remarks: RIR data contain garbage country: NL + +net: 2a06:e80::/29 +descr: Datashield, Inc. +remarks: fake offshore location (SC), traces back to NL +country: NL -- 2.26.2

2 1

[PATCH] override-{a{1,2},other}: regular batch of overrides
by Peter Müller 23 Dec '20

23 Dec '20

Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- overrides/override-a1.txt | 36 +++++ overrides/override-a2.txt | 290 +++++++++++++++++++++++++++++++++++ overrides/override-other.txt | 42 ++++- 3 files changed, 367 insertions(+), 1 deletion(-) diff --git a/overrides/override-a1.txt b/overrides/override-a1.txt index b1fa1b3..ca140ed 100644 --- a/overrides/override-a1.txt +++ b/overrides/override-a1.txt @@ -98,6 +98,11 @@ descr: KST Networks / ANONYMIZER remarks: VPN provider [high confidence, but not proofed] is-anonymous-proxy: yes +aut-num: AS55303 +descr: Eagle Sky Co., Lt +remarks: Autonomous System registered to offshore company, abuse contact is a freemail address, address says "0 Market Square, P.O. Box 364, Belize" +is-anonymous-proxy: yes + aut-num: AS58546 descr: Astrill VPN remarks: VPN provider @@ -395,6 +400,11 @@ descr: Secure Internet LLC remarks: VPN provider is-anonymous-proxy: yes +net: 45.142.122.0/24 +descr: Shtrauh Andrey +remarks: VPN provider [high confidence, but not proofed] +is-anonymous-proxy: yes + net: 45.151.115.0/24 descr: ikoProxies [high confidence, but not proofed] remarks: VPN provider located in NL @@ -566,6 +576,11 @@ descr: icedoutproxies.com remarks: VPN provider [high confidence, but not proofed] is-anonymous-proxy: yes +net: 77.247.181.160/28 +descr: Zwiebelfreunde e.V. +remarks: Tor relay provider +is-anonymous-proxy: yes + net: 80.254.74.0/20 descr: Monzoon / SwissVPN remarks: VPN provider [high confidence, but not proofed] @@ -811,6 +826,12 @@ descr: WIFI and PROXY NET / Atlantique Telecom remarks: VPN provider [high confidence, but not proofed] is-anonymous-proxy: yes +net: 154.54.248.0/24 +descr: Security Keepers (C07436169) +remarks: VPN provider [high confidence, but not proofed] +is-anonymous-proxy: yes +country: FR + net: 154.192.0.0/11 descr: Cloud Innovation Ltd. remarks: hijacked AFRINIC IP chunk, owned by suspicous offshore company, scattered across dirty networks worldwide - not a safe place to go @@ -972,6 +993,11 @@ descr: VPN Clients remarks: VPN provider is-anonymous-proxy: yes +net: 185.75.76.0/22 +descr: Private Host BV +remarks: VPN provider [high confidence, but not proofed] +is-anonymous-proxy: yes + net: 185.140.53.0/24 descr: Freedom of Speech VPN / nVPN / David Craig remarks: (Rogue) VPN provider @@ -1028,6 +1054,11 @@ remarks: (Rogue VPN provider), fake location (SC), traces back to NL is-anonymous-proxy: yes country: NL +net: 186.2.160.0/20 +descr: DDOS-GUARD CORP. +remarks: IP chunk owned by an offshore company, abuse contact is a freemail address, address says "1/2 Miles Northern Highway, Belize" +is-anonymous-proxy: yes + net: 188.72.80.0/21 descr: GZ Systems Limited / PureVPN remarks: VPN provider @@ -1093,6 +1124,11 @@ descr: GZ Systems Limited / PureVPN remarks: VPN provider is-anonymous-proxy: yes +net: 190.115.16.0/20 +descr: DDOS-GUARD CORP. +remarks: IP chunk owned by an offshore company, abuse contact is a freemail address, address says "1/2 Miles Northern Highway, Belize" +is-anonymous-proxy: yes + net: 191.96.1.0/23 descr: GZ Systems Limited / PureVPN remarks: VPN provider diff --git a/overrides/override-a2.txt b/overrides/override-a2.txt index a55c940..ffc0303 100644 --- a/overrides/override-a2.txt +++ b/overrides/override-a2.txt @@ -17,6 +17,26 @@ descr: Speedcast Communications, Inc. remarks: Satellite Internet provider is-satellite-provider: yes +aut-num: AS7058 +descr: ViaSat, Inc. +remarks: Satellite Internet provider +is-satellite-provider: yes + +aut-num: AS7155 +descr: ViaSat, Inc. +remarks: Satellite Internet provider [several satellite dial-in pools] +is-satellite-provider: yes + +aut-num: AS7168 +descr: ViaSat, Inc. +remarks: Satellite Internet provider +is-satellite-provider: yes + +aut-num: AS16491 +descr: ViaSat, Inc. +remarks: Satellite Internet provider [several satellite dial-in pools] +is-satellite-provider: yes + aut-num: AS5666 descr: Speedcast Communications, Inc. remarks: Satellite Internet provider @@ -32,6 +52,11 @@ descr: Satellite Communication Systems, Inc. remarks: Satellite Internet provider is-satellite-provider: yes +aut-num: AS11459 +descr: the Tennessean, a division of Gannett Satellite Information Network, Inc. +remarks: Satellite Internet provider +is-satellite-provider: yes + aut-num: AS12491 descr: Gitlat Satcom remarks: Satellite Internet provider @@ -52,6 +77,11 @@ descr: Signalhorn Trusted Networks GmbH / Satlynx remarks: Satellite Internet provider is-satellite-provider: yes +aut-num: AS18477 +descr: G2 Satellite Solutions Corporation +remarks: Satellite Internet provider +is-satellite-provider: yes + aut-num: AS19036 descr: Telesat Network Services Inc. remarks: Satellite Internet provider @@ -77,6 +107,11 @@ descr: Inmarsat Solutions B.V. remarks: Satellite Internet provider is-satellite-provider: yes +aut-num: AS25625 +descr: IP Access International +remarks: Satellite Internet provider +is-satellite-provider: yes + aut-num: AS26243 descr: Intelsat remarks: Satellite Internet provider @@ -92,6 +127,11 @@ descr: Eutelsat S.A. remarks: Satellite Internet provider is-satellite-provider: yes +aut-num: AS29259 +descr: IABG Teleport GmbH +remarks: Satellite Internet provider +is-satellite-provider: yes + aut-num: AS29286 descr: SKYLOGIC S.P.A. remarks: Satellite Internet provider [several satellite dial-in pools] @@ -112,6 +152,11 @@ descr: Inmarsat Government remarks: Satellite Internet provider is-satellite-provider: yes +aut-num: AS32247 +descr: Shaw Satellite Services, Inc. +remarks: Satellite Internet provider [high confidence, but not proofed] +is-satellite-provider: yes + aut-num: AS37296 descr: Afcom Satellite Networks Nigeria Limited remarks: Satellite Internet provider @@ -147,6 +192,26 @@ descr: AXESS Networks Solutions Germany GmbH / CeTEL GmbH / GeoLink remarks: Satellite Internet provider is-satellite-provider: yes +aut-num: AS40305 +descr: ViaSat, Inc. +remarks: Satellite Internet provider +is-satellite-provider: yes + +aut-num: AS40310 +descr: ViaSat, Inc. +remarks: Satellite Internet provider +is-satellite-provider: yes + +aut-num: AS40311 +descr: ViaSat, Inc. +remarks: Satellite Internet provider +is-satellite-provider: yes + +aut-num: AS40313 +descr: ViaSat, Inc. +remarks: Satellite Internet provider +is-satellite-provider: yes + aut-num: AS41659 descr: Arab Satellite Communications Organization remarks: Satellite Internet provider @@ -158,6 +223,11 @@ remarks: Chinese satellite Internet provider [high confidence, but not proofe is-satellite-provider: yes country: AP +aut-num: AS42726 +descr: BusinessCom CZ spol. s r.o. +remarks: Satellite Internet provider +is-satellite-provider: yes + aut-num: AS43905 descr: Telenor Satellite AS remarks: Satellite Internet provider @@ -178,6 +248,16 @@ descr: Orion Satellite Systems remarks: Satellite Internet provider is-satellite-provider: yes +aut-num: AS45607 +descr: Bangladesh Telecommunications Company Limited (BTCL) +remarks: Satellite Internet provider +is-satellite-provider: yes + +aut-num: AS46536 +descr: ViaSat, Inc. +remarks: Satellite Internet provider [several satellite dial-in pools] +is-satellite-provider: yes + aut-num: AS47339 descr: Speedcast Europe B.V. remarks: Satellite Internet provider @@ -198,6 +278,11 @@ descr: Gilat Satellite Networks Ltd. remarks: Satellite Internet provider is-satellite-provider: yes +aut-num: AS57535 +descr: RTV SRL Satellite Net +remarks: Satellite Internet provider +is-satellite-provider: yes + aut-num: AS58265 descr: Level421 GmbH remarks: Satellite Internet provider @@ -208,6 +293,11 @@ descr: Satellite Telecom LTD. remarks: Satellite Internet provider is-satellite-provider: yes +aut-num: AS60725 +descr: SES Networks +remarks: Satellite Internet provider [several satellite dial-in pools] +is-satellite-provider: yes + aut-num: AS62023 descr: NYNEX satellite OHG remarks: Satellite Internet provider @@ -218,6 +308,11 @@ descr: Sky Telecom State Company remarks: Satellite Internet provider is-satellite-provider: yes +aut-num: AS133155 +descr: Satellite Connection +remarks: Satellite Internet provider +is-satellite-provider: yes + aut-num: AS135324 descr: IPStar remarks: Satellite Internet provider [high confidence, but not proofed] @@ -233,11 +328,21 @@ descr: Alpha Sattelite Network remarks: Satellite Internet provider is-satellite-provider: yes +aut-num: AS201554 +descr: SES Germany GmbH +remarks: Satellite Internet provider +is-satellite-provider: yes + aut-num: AS203770 descr: Matooma SAS remarks: Satellite Internet provider is-satellite-provider: yes +aut-num: AS208756 +descr: ALCON TELECOM LTD +remarks: Satellite Internet provider +is-satellite-provider: yes + aut-num: AS393582 descr: VIDEO DIRECT SATELLITE & ENTERTAINMENT / WisperISP remarks: Satellite Internet provider @@ -248,6 +353,16 @@ descr: Inmarsat Solutions US Inc remarks: Satellite Internet provider is-satellite-provider: yes +aut-num: AS394771 +descr: Thales Avionics +remarks: Satellite Internet provider [high confidence, but not proofed] +is-satellite-provider: yes + +aut-num: AS398736 +descr: IRIDIUM SATELLITE, LLC +remarks: Satellite Internet provider +is-satellite-provider: yes + net: 5.8.184.0/21 descr: Skylogic Espana S.L. remarks: Satellite Internet provider @@ -358,6 +473,11 @@ descr: Intersat Africa remarks: Satellite Internet provider is-satellite-provider: yes +net: 41.187.187.0/24 +descr: Noor Satellite #1 +remarks: Satellite Internet provider +is-satellite-provider: yes + net: 41.190.132.0/21 descr: Metronet - Infocom Client Networks / Intelsat / SkyVision remarks: Satellite Internet provider @@ -413,6 +533,21 @@ descr: Speedcast Limited remarks: Satellite Internet provider is-satellite-provider: yes +net: 45.56.238.0/23 +descr: NAVARINO TELECOM - Satellite Service - Iridium +remarks: Satellite Internet provider +is-satellite-provider: yes + +net: 45.56.240.0/20 +descr: NAVARINO TELECOM - Satellite Service 2 +remarks: Satellite Internet provider +is-satellite-provider: yes + +net: 45.250.224.0/22 +descr: SPACE VISION DIGITAL NETWORK PVT. LTD. +remarks: Satellite Internet provider +is-satellite-provider: yes + net: 45.174.8.0/24 descr: ENLACES GUAYANA, C.A. remarks: Satellite Internet provider @@ -513,6 +648,41 @@ descr: Inmarsat Government remarks: Satellite Internet provider is-satellite-provider: yes +net: 65.99.179.0/24 +descr: Viasat Satellite Services AB +remarks: Satellite Internet provider +is-satellite-provider: yes + +net: 65.99.180.0/24 +descr: Viasat Satellite Services AB +remarks: Satellite Internet provider +is-satellite-provider: yes + +net: 65.99.182.0/24 +descr: Viasat Satellite Services AB +remarks: Satellite Internet provider +is-satellite-provider: yes + +net: 65.99.184.0/24 +descr: Viasat Satellite Services AB +remarks: Satellite Internet provider +is-satellite-provider: yes + +net: 65.99.186.0/24 +descr: Viasat Satellite Services AB +remarks: Satellite Internet provider +is-satellite-provider: yes + +net: 65.99.187.0/24 +descr: Viasat Satellite Services AB +remarks: Satellite Internet provider +is-satellite-provider: yes + +net: 65.99.190.0/23 +descr: Viasat Satellite Services AB +remarks: Satellite Internet provider +is-satellite-provider: yes + net: 66.133.0.0/24 descr: Americacom Inc. remarks: Satellite Internet provider @@ -613,6 +783,11 @@ descr: Stratos Communications Inc. remarks: Satellite Internet provider is-satellite-provider: yes +net: 69.21.165.0/24 +descr: Satellite Receivers Ltd. +remarks: Satellite Internet provider [high confidence, but not proofed] +is-satellite-provider: yes + net: 72.2.224.0/20 descr: Speedcast Communications, Inc. remarks: Satellite Internet provider @@ -663,11 +838,41 @@ descr: Breiband.no AS remarks: Satellite Internet provider is-satellite-provider: yes +net: 82.96.38.0/23 +descr: Viasat Satellite Services AB +remarks: Satellite Internet provider +is-satellite-provider: yes + +net: 82.96.41.0/24 +descr: Viasat Satellite Services AB +remarks: Satellite Internet provider +is-satellite-provider: yes + +net: 82.96.42.0/24 +descr: Viasat Satellite Services AB +remarks: Satellite Internet provider +is-satellite-provider: yes + +net: 82.96.56.0/24 +descr: Viasat Satellite Services AB +remarks: Satellite Internet provider +is-satellite-provider: yes + +net: 82.96.56.0/23 +descr: Viasat Satellite Services AB +remarks: Satellite Internet provider +is-satellite-provider: yes + net: 82.103.105.0/24 descr: ADH_MOBIL_Basic_and_ADH_MOBIL_Premium remarks: Satellite Internet provider is-satellite-provider: yes +net: 83.140.124.0/22 +descr: Viasat Satellite Services AB +remarks: Satellite Internet provider +is-satellite-provider: yes + net: 84.22.64.0/19 descr: Eutelsat S.A. remarks: Satellite Internet provider @@ -683,6 +888,11 @@ descr: SKYLOGIC S.P.A. remarks: Satellite Internet provider is-satellite-provider: yes +net: 85.112.184.0/22 +descr: Viasat Satellite Services AB +remarks: Satellite Internet provider +is-satellite-provider: yes + net: 87.238.112.0/21 descr: AXESS Networks Solutions Germany GmbH remarks: Satellite Internet provider @@ -788,6 +998,11 @@ descr: IP COPTER - SATELLITE INFRASTRUCTURE remarks: Satellite Internet provider is-satellite-provider: yes +net: 98.103.50.0/24 +descr: Satellite Receivers Ltd. +remarks: Satellite Internet provider [high confidence, but not proofed] +is-satellite-provider: yes + net: 102.67.168.0/22 descr: Radical Technology Network Limited remarks: Satellite Internet provider [high confidence, but not proofed] @@ -943,6 +1158,31 @@ descr: Media Broadcast Satellite GmbH remarks: Satellite Internet provider is-satellite-provider: yes +net: 146.247.154.0/24 +descr: Viasat Satellite Services AB +remarks: Satellite Internet provider +is-satellite-provider: yes + +net: 146.247.226.0/24 +descr: Viasat Satellite Services AB +remarks: Satellite Internet provider +is-satellite-provider: yes + +net: 146.247.240.0/24 +descr: Viasat Satellite Services AB +remarks: Satellite Internet provider +is-satellite-provider: yes + +net: 146.247.246.0/24 +descr: Viasat Satellite Services AB +remarks: Satellite Internet provider +is-satellite-provider: yes + +net: 146.247.254.0/24 +descr: Viasat Satellite Services AB +remarks: Satellite Internet provider +is-satellite-provider: yes + net: 154.73.28.0/22 descr: RAWAFED Libya remarks: Satellite Internet provider @@ -953,6 +1193,11 @@ descr: Bharat Communication Systems remarks: Satellite Internet provider [high confidence, but not proofed] is-satellite-provider: yes +net: 159.54.112.0/20 +descr: Gannett Satellite Information Network, LLC. +remarks: Satellite Internet provider +is-satellite-provider: yes + net: 161.30.0.0/16 descr: Inmarsat remarks: Satellite Internet provider @@ -1173,6 +1418,41 @@ descr: Filiago GmbH und Co. KG remarks: Satellite Internet provider is-satellite-provider: yes +net: 185.165.172.0/24 +descr: Viasat Satellite Services AB +remarks: Satellite Internet provider +is-satellite-provider: yes + +net: 185.166.205.0/24 +descr: Viasat Satellite Services AB +remarks: Satellite Internet provider +is-satellite-provider: yes + +net: 185.168.240.0/23 +descr: Viasat Satellite Services AB +remarks: Satellite Internet provider +is-satellite-provider: yes + +net: 185.178.140.0/24 +descr: Viasat Satellite Services AB +remarks: Satellite Internet provider +is-satellite-provider: yes + +net: 185.178.143.0/24 +descr: Viasat Satellite Services AB +remarks: Satellite Internet provider +is-satellite-provider: yes + +net: 185.181.216.0/24 +descr: Viasat Satellite Services AB +remarks: Satellite Internet provider +is-satellite-provider: yes + +net: 185.181.218.0/23 +descr: Viasat Satellite Services AB +remarks: Satellite Internet provider +is-satellite-provider: yes + net: 185.182.100.0/22 descr: Satellite Ltd remarks: Satellite Internet provider @@ -1543,6 +1823,11 @@ descr: Telenor UK Ltd. remarks: Satellite Internet provider is-satellite-provider: yes +net: 218.30.30.0/23 +descr: GuangDong South Satellite Telecommunication Service Co., Ltd. +remarks: Satellite Internet provider +is-satellite-provider: yes + net: 2001:2030:3e::/48 descr: Arab Satellite Communications Organization remarks: Satellite Internet provider @@ -1558,6 +1843,11 @@ descr: Asia Broadcast Satellite Ltd remarks: Satellite Internet provider is-satellite-provider: yes +net: 2602:fd3a::/36 +descr: ViaSat, Inc. +remarks: Satellite Internet provider +is-satellite-provider: yes + net: 2604:5700::/32 descr: SES Americom Inc. remarks: Satellite Internet provider diff --git a/overrides/override-other.txt b/overrides/override-other.txt index bf265d0..ef1e779 100644 --- a/overrides/override-other.txt +++ b/overrides/override-other.txt @@ -15,7 +15,7 @@ aut-num: AS6134 descr: XNNET LLC -remarks: traces back to an unknown oversea location (Hong Kong?), seems to tamper with RIR data +remarks: traces back to an unknown oversea location (HK?), seems to tamper with RIR data country: HK aut-num: AS8359 @@ -173,6 +173,21 @@ descr: Clayer Limited remarks: part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to AP region country: AP +aut-num: AS139330 +descr: SANREN DATA LIMITED +remarks: IP hijacker located somewhere in AP region, tampers with RIR data +country: AP + +aut-num: AS140733 +descr: Wujidun Network Limited +remarks: part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to AP region +country: AP + +aut-num: AS200845 +descr: AVATEL TELECOM +remarks: ISP located in ES, but some RIR data for announced prefixes contain garbage +country: ES + aut-num: AS201133 descr: Verdina Ltd. remarks: ISP located in BG, but RIR data for announced prefixes contain garbage @@ -228,6 +243,11 @@ descr: IP Connect Inc. remarks: fake offshore location (SC), traces back to NL country: NL +aut-num: AS262254 +descr: DDOS-GUARD CORP. +remarks: fake offshore location (BZ), traces back to RU +country: RU + aut-num: AS328543 descr: Sun Network Company Limited remarks: IP hijacker, traces back to AP region @@ -293,6 +313,11 @@ descr: GlobalCache Technology CO., Ltd. remarks: claims to be located in DE, but traces back to HK country: HK +net: 45.148.167.0/24 +descr: US AFG 20200130 +remarks: claims to be located in US, but traces back to SK +country: SK + net: 47.60.0.0/14 descr: Vodafone US Inc. remarks: large Vodafone IP chunk used in ES, but assigned by ARIN (inaccurate data) @@ -368,16 +393,31 @@ descr: WorldStream (LATAM) BV remarks: LACNIC IP chunk solely used in NL (inaccurate data) country: NL +net: 192.12.3.0/24 +descr: Deep Eddy Internet Consulting +remarks: claims to be located in US, traces back to AP region +country: AP + net: 193.29.12.0/22 descr: Bunea TELECOM SRL remarks: RIR data contain garbage for this network country: RO +net: 193.119.0.0/19 +descr: NetConn Services Ltd +remarks: APNIC chunk owned by a HK-based company, routed to AP region, but assigned to SC +country: AP + net: 198.144.120.0/23 descr: Amarutu Technology Ltd. / KoDDoS / ESecurity remarks: fake offshore location (BZ), traces back to NL country: NL +net: 202.128.108.0/23 +descr: NetConn Services Ltd +remarks: APNIC chunk owned by a HK-based company, routed to AP region, but assigned to SC +country: AP + net: 2a02:e00:ffe7::/48 descr: Bradler & Krantz GmbH & Co. KG remarks: allocated to DE, but actually announced from LT -- 2.26.2

1 0

[PATCH] override-a1: delete orphaned empty line
by Peter Müller 23 Dec '20

23 Dec '20

Fixes: #12550 Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- overrides/override-a1.txt | 1 - 1 file changed, 1 deletion(-) diff --git a/overrides/override-a1.txt b/overrides/override-a1.txt index b1fa1b3..acb3ef0 100644 --- a/overrides/override-a1.txt +++ b/overrides/override-a1.txt @@ -1221,7 +1221,6 @@ is-anonymous-proxy: yes net: 202.9.16.0/20 descr: VPNsolutions Pty Ltd remarks: VPN provider - is-anonymous-proxy: yes net: 202.152.146.0/24 -- 2.26.2

1 0

[PATCH] location-importer.in: fix typo
by Peter Müller 23 Dec '20

23 Dec '20

Fixes: #12549 Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- src/python/location-importer.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/python/location-importer.in b/src/python/location-importer.in index 2dec89e..a4be445 100644 --- a/src/python/location-importer.in +++ b/src/python/location-importer.in @@ -990,7 +990,7 @@ class CLI(object): ) else: - log.warning("Unsupport type: %s" % type) + log.warning("Unsupported type: %s" % type) @staticmethod def _parse_bool(block, key): -- 2.26.2

1 0

Fwd: RIPE: Impact of NWI-10 on Country Codes in Delegated Statistics
by Peter Müller 22 Dec '20

22 Dec '20

Hi, in case anybody is interested in this as well: https://labs.ripe.net/Members/wilhelm/impact-of-nwi-10-on-country-codes-in-… Thanks, and best regards, Peter Müller

1 0

[PATCH] override-other: regular batch of various overrides
by Peter Müller 21 Dec '20

21 Dec '20

Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- overrides/override-other.txt | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/overrides/override-other.txt b/overrides/override-other.txt index 09d87fc..bf265d0 100644 --- a/overrides/override-other.txt +++ b/overrides/override-other.txt @@ -238,6 +238,26 @@ descr: PEG TECH INC remarks: ISP located in HK, tampers with RIR data country: HK +net: 5.1.68.0/24 +descr: GaiacomLC +remarks: routed to DE, inaccurate RIR data +country: DE + +net: 5.1.69.0/24 +descr: GaiacomLC +remarks: routed to DE, inaccurate RIR data +country: DE + +net: 5.1.83.0/24 +descr: GaiacomLC +remarks: routed to DE, inaccurate RIR data +country: DE + +net: 5.1.88.0/24 +descr: GaiacomLC +remarks: routed to DE, inaccurate RIR data +country: DE + net: 5.252.32.0/22 descr: StormWall s.r.o. remarks: claims to be located in DE, but traces back to somewhere else in central Europe @@ -298,6 +318,11 @@ descr: I.C.S. Trabia-Network S.R.L. remarks: fake offshore location (HK), traces back to MD country: MD +net: 130.117.0.0/16 +descr: PSINet, Inc. (PSI) / Cogent Communications +remarks: Cogent IP range used in Europe, according to ARIN whois ("COGENT-EUROPEAN-OPERATIONS-001") +country: EU + net: 178.239.20.0/24 descr: Anthony Marshall / Game Hosting Net / FlokiNET Ltd. remarks: fake location (BA), traces back to RO @@ -308,6 +333,11 @@ descr: FlokiNET Ltd. remarks: fake offshore location (SC), traces back to RO country: RO +net: 185.140.204.0/22 +descr: Hornetsecurity GmbH +remarks: all suballocations are used in DE, but are assigned to US +country: DE + net: 185.175.93.0/24 descr: Perfect Hosting Solutions remarks: bulletproof ISP related to AS204655, traces back to BG -- 2.26.2

2 1

Core Update 153 (testing) report
by Peter Müller 14 Dec '20

14 Dec '20

Hello development folks, hello location folks (CC'ed), Core Update 153 (testing, see: https://blog.ipfire.org/post/ipfire-2-25-core-update-153-available-for-test…) is running here for a few days by now without any known issues so far. After downloading a recent (Saturday or later) location database, I can confirm its data to be less inaccurate by now. The output of the following commands are an ideal measurement for Q&A purposes since they differ from older location databases which used the (crappy) delegated-extended-latest files, which we now only need for regions covered by ARIN and LACNINC, as they do not publish better data: > [root@maverick ~]# location lookup 51.15.0.1 > 51.15.0.1: > Network : 51.15.0.0/17 > Country : Netherlands > Autonomous System : AS12876 - ONLINE S.A.S. > [root@maverick ~]# location lookup 51.15.129.1 > 51.15.129.1: > Network : 51.15.0.0/16 > Country : France > Autonomous System : AS12876 - ONLINE S.A.S. > [root@maverick ~]# location lookup 95.216.0.1 > 95.216.0.1: > Network : 95.216.0.0/17 > Country : Finland > Autonomous System : AS24940 - Hetzner Online GmbH Location filter has not been tested, but since we built safeguards into it in Core Update 152 and implemented additional checks to exclude bogus RIR data as best as we can - not to mention Michael spending weeks on re- implementing a fast (!) algorithm for dumping libloc's tree planar for xt_geoip module, which cannot reliably handle overlapping networks -, I do not expect any issues here. As mentioned earlier, I am unable to reproduce Suricata 6.0 eating up an unreasonable amount of CPU time on my testing machine, which runs on an Intel N3150, thus apparently not being affected by the problem especially virtualised users seem to experience. Actually, CPU load is a bit lower than it was in Core Update 152, while usual network load and system resources remained unchanged. OpenVPN road-warrior connections were reported to be notably faster, but I could not test them by myself for technical reasons. Thanks to Michael again for cleaning up this mess (as explained in commit https://git.ipfire.org/?p=ipfire-2.x.git;a=commit;h=d6989b4b0b42937485f5008…). :-) Tested IPFire functionalities in detail: - IPsec (N2N connections only) - Squid (authentication enabled, using an upstream proxy) - OpenVPN (RW connections only) - IPS/Suricata (with Emerging Threats community ruleset enabled) - Guardian - Quality of Service - DNS (using DNS over TLS and strict QNAME minimisation) - Dynamic DNS - Tor (relay mode) I look forward to the release of this Core Update, as it finally comes with an location database as less inaccurate (given the rather patchy RIR data, I try to avoid the term "accuracy" here) as we could do with the data we have at hand. Thanks, and best regards, Peter Müller P.S.: Reading Unbound's latest release note, I stumbled across re-using TCP and TLS connections. In case this works as I expect it to do, this should make DNS over TCP (rather dull) and TLS (more interesting in terms of privacy) significantly faster in Core Update 154.

1 0

[PATCH] override-{a[1, 3}, other}: add overrides for Akamai and some AP-based IP hijackers
by Peter Müller 14 Dec '20

14 Dec '20

Those came to my attention last night... These two "Cloud Innovation Ltd." networks are especially interesting, since they strongly suggest to be hijacked or stolen from AFRINIC for the sole purpose to be routed by various dirty networks worldwide. Some of them host a decent amount of phishing and C&Cs, while others seem to be used as proxy infrastructure by miscreants, which is why an A1 flag seems to be justified from my point of view. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- overrides/override-a1.txt | 21 +++++++++++++++++++++ overrides/override-a3.txt | 10 ++++++++++ overrides/override-other.txt | 35 +++++++++++++++++++++++++++++++++++ 3 files changed, 66 insertions(+) diff --git a/overrides/override-a1.txt b/overrides/override-a1.txt index 7aca339..6d9132a 100644 --- a/overrides/override-a1.txt +++ b/overrides/override-a1.txt @@ -406,6 +406,11 @@ descr: Express VPN International Ltd remarks: VPN provider is-anonymous-proxy: yes +net: 45.192.0.0/12 +descr: Cloud Innovation Ltd. +remarks: hijacked AFRINIC IP chunk owned by an offshore company, routed to several dirty networks worldwide, cannot tell what is going on here +is-anonymous-proxy: yes + net: 45.220.72.0/22 descr: Low budget VPN service remarks: VPN provider @@ -611,6 +616,11 @@ descr: CloudMine NET remarks: VPN provider [high confidence, but not proofed] is-anonymous-proxy: yes +net: 92.118.204.0/22 +descr: Mo's Operations GmbH +remarks: VPN provider [high confidence, but not proofed] +is-anonymous-proxy: yes + net: 94.199.160.0/23 descr: MIK Telecom VPN pool remarks: VPN provider @@ -801,6 +811,11 @@ descr: WIFI and PROXY NET / Atlantique Telecom remarks: VPN provider [high confidence, but not proofed] is-anonymous-proxy: yes +net: 154.192.0.0/11 +descr: Cloud Innovation Ltd. +remarks: hijacked AFRINIC IP chunk, owned by suspicous offshore company, scattered across dirty networks worldwide - not a safe place to go +is-anonymous-proxy: yes + net: 161.129.60.0/24 descr: 10VPN Hosting remarks: VPN provider @@ -1167,6 +1182,11 @@ descr: LogicWeb Inc. / BGRVPN / Private Internet Access / VPNetworks / Cookie remarks: large IP chunk mostly used by VPN providers is-anonymous-proxy: yes +net: 196.61.192.0/20 +descr: Inspiring Networks LTD +remarks: hijacked (?) IP network owned by an offshore company [high confidence, but not proofed] +is-anonymous-proxy: yes + net: 197.221.161.0/24 descr: VPNClientPublics remarks: VPN provider @@ -1195,6 +1215,7 @@ is-anonymous-proxy: yes net: 202.9.16.0/20 descr: VPNsolutions Pty Ltd remarks: VPN provider + is-anonymous-proxy: yes net: 202.152.146.0/24 diff --git a/overrides/override-a3.txt b/overrides/override-a3.txt index 07b2621..1112e6d 100644 --- a/overrides/override-a3.txt +++ b/overrides/override-a3.txt @@ -25,6 +25,16 @@ descr: DirectNIC, Ltd. remarks: Generic anycast network [high confidence, but not proofed] is-anycast: yes +aut-num: AS16625 +descr: Akamai Technologies, Inc. +remarks: Worldwide CDN, does not make sense to assign their networks to a specific country +is-anycast: yes + +aut-num: AS20940 +descr: Akamai International BV +remarks: Worldwide CDN, does not make sense to assign their networks to a specific country +is-anycast: yes + aut-num: AS31529 descr: DENIC eG remarks: TLD operator's anycast network diff --git a/overrides/override-other.txt b/overrides/override-other.txt index 98ea79b..5eb7796 100644 --- a/overrides/override-other.txt +++ b/overrides/override-other.txt @@ -28,6 +28,16 @@ descr: KLAYER LLC remarks: part of the "Asline" IP hijacking gang, traces back to AP region country: AP +aut-num: AS22769 +descr: DDOSING NETWORK +remarks: IP hijacker located somewhere in AP, massively tampers with RIR data +country: AP + +aut-num: AS24009 +descr: HK UNITE TELECOMMUNICATIONS DEVELOPMENT LIMITED +remarks: IP hijacker (?) located in HK, tampers with RIR data +country: HK + aut-num: AS24700 descr: Yes Networks Unlimited Ltd remarks: traces to UA, but some RIR entries seem to contain garbage (VG) @@ -43,6 +53,11 @@ descr: IP Interactive UG (haftungsbeschraenkt) remarks: ISP located in BG, but RIR data for announced prefixes contain garbage country: BG +aut-num: AS35251 +descr: NetLab +remarks: tampers with RIR data, most probabyl located in HK +country: HK + aut-num: AS35478 descr: Buena Telecom SRL remarks: ISP located in RO, but RIR data for announced prefixes contain garbage @@ -123,11 +138,21 @@ descr: Network Dedicated SAS remarks: bulletproof ISP, claims to be located in CH, but traces to NL country: NL +aut-num: AS62468 +descr: VpsQuan L.L.C. +remarks: claims to be located in US, but traces to HK +country: HK + aut-num: AS134548 descr: DXTL Tseung Kwan O Service remarks: tampers with RIR data, traces back to AP region country: AP +aut-num: AS137443 +descr: Anchnet Asia Limited +remarks: IP hijacker located in HK, tampers with RIR data +country: HK + aut-num: AS137951 descr: Clayer Limited remarks: part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to AP region @@ -213,6 +238,16 @@ descr: FlokiNET Ltd. remarks: fake offshore location (SC), traces back to RO country: RO +net: 45.93.16.0/22 +descr: IPv4 Superhub Limited +remarks: network owned by an HK company, traces back to HK as well - but is assigned to DE. Nice try... +country: HK + +net: 45.134.144.0/22 +descr: IPv4 Superhub Limited +remarks: same as 45.93.16.0/22 +country: HK + net: 45.145.36.0/22 descr: GlobalCache Technology CO., Ltd. remarks: claims to be located in DE, but traces back to HK -- 2.20.1

3 3

[PATCH] override-{a1,other}: regular batch of overrides
by Peter Müller 12 Dec '20

12 Dec '20

Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- overrides/override-a1.txt | 6 +++++ overrides/override-other.txt | 51 ++++++++++++++++++++++++++++++------ 2 files changed, 49 insertions(+), 8 deletions(-) diff --git a/overrides/override-a1.txt b/overrides/override-a1.txt index 7aca339..a0a4404 100644 --- a/overrides/override-a1.txt +++ b/overrides/override-a1.txt @@ -1007,6 +1007,12 @@ descr: Angelo Kreikamp trading as Forhosting / Freedom of Speech VPN / nVPN / remarks: (Rogue) VPN provider is-anonymous-proxy: yes +net: 185.244.29.0/24 +descr: NINAZU VPN Service / Gerber EDV / David Craig +remarks: (Rogue VPN provider), fake location (SC), traces back to NL +is-anonymous-proxy: yes +country: NL + net: 188.72.80.0/21 descr: GZ Systems Limited / PureVPN remarks: VPN provider diff --git a/overrides/override-other.txt b/overrides/override-other.txt index 98ea79b..fb60d97 100644 --- a/overrides/override-other.txt +++ b/overrides/override-other.txt @@ -13,6 +13,16 @@ # Please keep this file sorted. # +aut-num: AS6134 +descr: XNNET LLC +remarks: traces back to an unknown oversea location (Hong Kong?), seems to tamper with RIR data +country: HK + +aut-num: AS8359 +descr: MTS PJSC +remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage +country: RU + aut-num: AS12025 descr: Iron Mountain Data Center remarks: ISP located in US, but some RIR data for announced prefixes contain garbage @@ -78,10 +88,10 @@ descr: UKSERVERS remarks: ISP located in GB, but some RIR data for announced prefixes contain garbage country: GB -aut-num: AS44446 -descr: OOO SibirInvest -remarks: bulletproof ISP (related to AS204655), traces back to NL and BG -country: EU +aut-num: AS42960 +descr: Cloud Management LLC +remarks: tampers with RIR data, traces back to HK +country: HK aut-num: AS48090 descr: PPTECHNOLOGY LIMITED @@ -103,6 +113,11 @@ descr: Smart Telecom S.A.R.L remarks: tampers with RIR data, traces back to RU country: RU +aut-num: AS55933 +descr: Cloudie Limited +remarks: part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to AP region +country: AP + aut-num: AS56611 descr: REBA Communications BV remarks: bulletproof ISP (related to AS202425) located in NL @@ -188,6 +203,11 @@ descr: IP Connect Inc. remarks: fake offshore location (SC), traces back to NL country: NL +aut-num: AS328543 +descr: Sun Network Company Limited +remarks: IP hijacker, traces back to AP region +country: AP + aut-num: AS398478 descr: PEG TECH INC remarks: ISP located in HK, tampers with RIR data @@ -253,20 +273,35 @@ descr: FlokiNET Ltd. remarks: fake offshore location (SC), traces back to RO country: RO +net: 185.175.93.0/24 +descr: Perfect Hosting Solutions +remarks: bulletproof ISP related to AS204655, traces back to BG +country: BG + net: 185.169.253.0/24 descr: Amarutu Technology Ltd. / KoDDoS / ESecurity remarks: fake offshore location (BZ), traces back to US country: US +net: 185.193.91.0/24 +descr: Romanenko Stanislav Sergeevich +remarks: bulletproof ISP related to AS204655, traces back to BG +country: BG + net: 185.193.124.0/22 descr: ab stract / Njalla remarks: bogus RIR data pointing to the unpopulated Bouvet Island (BV), suballocations trace back to SE country: SE -net: 185.244.29.0/24 -descr: NINAZU VPN Service / Gerber EDV / David Craig -remarks: bulletproof ISP, fake location (SC), traces back to GB -country: GB +net: 185.227.152.0/22 +descr: XinYuan Interconnect (HONG KONG [sic!]) Limited +remarks: claims to be located in DE, traces back to HK +country: HK + +net: 190.2.128.0/19 +descr: WorldStream (LATAM) BV +remarks: LACNIC IP chunk solely used in NL (inaccurate data) +country: NL net: 193.29.12.0/22 descr: Bunea TELECOM SRL -- 2.20.1

1 0

2024

2023

2022

2021

2020

2019

2018

2017

Location December 2020