Location January 2021

location@lists.ipfire.org

2 participants
6 discussions

[PATCH] location-importer.in: skip networks with unknown country codes
by Peter Müller 04 Feb '21

04 Feb '21

There is no sense in parsing and storting networks whose country codes cannot be found in the ISO-3166-x country code table. This avoids side effects in applications using the location database, and introduces another sanity check to compensate bogus RIR data. On location02, this affects some networks from APNIC (country code: ZZ) as well as a bunch of smaller allocations within the RIPE region still tagged to CS or YU (Yugoslavia). To my surprise, no network tagged as SU (Soviet Union) was found - while the NIC for .su TLD is still operational. :-) Fixes: #12510 Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- src/python/location-importer.in | 42 ++++++++++++++++++++++----------- 1 file changed, 28 insertions(+), 14 deletions(-) diff --git a/src/python/location-importer.in b/src/python/location-importer.in index 864eab1..89b556a 100644 --- a/src/python/location-importer.in +++ b/src/python/location-importer.in @@ -388,10 +388,17 @@ class CLI(object): TRUNCATE TABLE networks; """) + # Fetch all valid country codes to check parsed networks aganist... + rows = self.db.query("SELECT * FROM countries ORDER BY country_code") + validcountries = [] + + for row in rows: + validcountries.append(row.country_code) + for source in location.importer.WHOIS_SOURCES: with downloader.request(source, return_blocks=True) as f: for block in f: - self._parse_block(block) + self._parse_block(block, validcountries) # Process all parsed networks from every RIR we happen to have access to, # insert the largest network chunks into the networks table immediately... @@ -467,7 +474,7 @@ class CLI(object): # Download data with downloader.request(source) as f: for line in f: - self._parse_line(line) + self._parse_line(line, validcountries) def _check_parsed_network(self, network): """ @@ -532,7 +539,7 @@ class CLI(object): # be suitable for libloc consumption... return True - def _parse_block(self, block): + def _parse_block(self, block, validcountries = None): # Get first line to find out what type of block this is line = block[0] @@ -542,7 +549,7 @@ class CLI(object): # inetnum if line.startswith("inet6num:") or line.startswith("inetnum:"): - return self._parse_inetnum_block(block) + return self._parse_inetnum_block(block, validcountries) # organisation elif line.startswith("organisation:"): @@ -573,7 +580,7 @@ class CLI(object): autnum.get("asn"), autnum.get("org"), ) - def _parse_inetnum_block(self, block): + def _parse_inetnum_block(self, block, validcountries = None): log.debug("Parsing inetnum block:") inetnum = {} @@ -624,17 +631,17 @@ class CLI(object): if not inetnum or not "country" in inetnum: return - # Skip objects with bogus country code 'ZZ' - if inetnum.get("country") == "ZZ": - log.warning("Skipping network with bogus country 'ZZ': %s" % \ - (inetnum.get("inet6num") or inetnum.get("inetnum"))) - return - network = ipaddress.ip_network(inetnum.get("inet6num") or inetnum.get("inetnum"), strict=False) if not self._check_parsed_network(network): return + # Skip objects with unknown country codes + if validcountries and inetnum.get("country") not in validcountries: + log.warning("Skipping network with bogus country '%s': %s" % \ + (inetnum.get("country"), inetnum.get("inet6num") or inetnum.get("inetnum"))) + return + self.db.execute("INSERT INTO _rirdata(network, country) \ VALUES(%s, %s) ON CONFLICT (network) DO UPDATE SET country = excluded.country", "%s" % network, inetnum.get("country"), @@ -659,7 +666,7 @@ class CLI(object): org.get("organisation"), org.get("org-name"), ) - def _parse_line(self, line): + def _parse_line(self, line, validcountries = None): # Skip version line if line.startswith("2"): return @@ -674,8 +681,15 @@ class CLI(object): log.warning("Could not parse line: %s" % line) return - # Skip any lines that are for stats only - if country_code == "*": + # Skip any lines that are for stats only or do not have a country + # code at all (avoids log spam below) + if not country_code or country_code == '*': + return + + # Skip objects with unknown country codes + if validcountries and country_code not in validcountries: + log.warning("Skipping line with bogus country '%s': %s" % \ + (country_code, line)) return if type in ("ipv6", "ipv4"): -- 2.20.1

1 2

[PATCH] location-importer.in: reduce log noise for unusable networks
by Peter Müller 25 Jan '21

25 Jan '21

These are nothing to worry about, which is why debug log facility is more suitable here than informational or warning. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- src/python/location-importer.in | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/src/python/location-importer.in b/src/python/location-importer.in index a4be445..c5ebb54 100644 --- a/src/python/location-importer.in +++ b/src/python/location-importer.in @@ -494,12 +494,12 @@ class CLI(object): return False if not network.is_global: - log.warning("Skipping non-globally routable network: %s" % network) + log.debug("Skipping non-globally routable network: %s" % network) return False if network.version == 4: if network.prefixlen < 7: - log.warning("Skipping too big IP chunk: %s" % network) + log.debug("Skipping too big IP chunk: %s" % network) return False if network.prefixlen > 24: @@ -507,12 +507,12 @@ class CLI(object): return False if str(network.network_address) == "0.0.0.0": - log.warning("Skipping network based on 0.0.0.0: %s" % network) + log.debug("Skipping network based on 0.0.0.0: %s" % network) return False elif network.version == 6: if network.prefixlen < 10: - log.warning("Skipping too big IP chunk: %s" % network) + log.debug("Skipping too big IP chunk: %s" % network) return False if network.prefixlen > 48: @@ -520,7 +520,7 @@ class CLI(object): return False if str(network.network_address) == "::": - log.warning("Skipping network based on '::': %s" % network) + log.debug("Skipping network based on '::': %s" % network) return False else: @@ -587,7 +587,7 @@ class CLI(object): # not managed by that specific RIR... if key == "netname": if re.match(r"(ERX-NETBLOCK|(AFRINIC|ARIN|LACNIC|RIPE)-CIDR-BLOCK|IANA-NETBLOCK-\d{1,3}|NON-RIPE-NCC-MANAGED-ADDRESS-BLOCK)", val.strip()): - log.warning("Skipping record indicating historic/orphaned data: %s" % val.strip()) + log.debug("Skipping record indicating historic/orphaned data: %s" % val.strip()) return if key == "inetnum": -- 2.26.2

2 1

[PATCH] location-importer.in: delete 6to4 IPv6 space as well
by Peter Müller 25 Jan '21

25 Jan '21

2002::/16 is an anycast prefix for 6to4 scenarios, as specified in RFC 3068. We currently process an announcement from Hurricane Electric for it, and since it is an anycast network, multiple entities across the world announce it as well. Thereof, it does not make sense to include it in the database - as of today, we do not have a country for it, either. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- src/python/location-importer.in | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/python/location-importer.in b/src/python/location-importer.in index a4be445..1a025bb 100644 --- a/src/python/location-importer.in +++ b/src/python/location-importer.in @@ -768,8 +768,9 @@ class CLI(object): -- DELETE link local address space DELETE FROM announcements WHERE family(network) = 4 AND network <<= '169.254.0.0/16'; - -- DELETE IPv6 to IPv4 (6to4) address space + -- DELETE IPv6 to IPv4 (6to4) address space (RFC 3068) DELETE FROM announcements WHERE family(network) = 4 AND network <<= '192.88.99.0/24'; + DELETE FROM announcements WHERE family(network) = 6 AND network <<= '2002::/16'; -- DELETE multicast and reserved address space DELETE FROM announcements WHERE family(network) = 4 AND network <<= '224.0.0.0/4'; -- 2.26.2

2 1

[PATCH] overrides-*: weekly batch of various overrides
by Peter Müller 22 Jan '21

22 Jan '21

Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- overrides/override-a1.txt | 5 ++ overrides/override-a2.txt | 105 +++++++++++++++++++++++++++++++++-- overrides/override-other.txt | 25 +++++++++ 3 files changed, 130 insertions(+), 5 deletions(-) diff --git a/overrides/override-a1.txt b/overrides/override-a1.txt index 6f04bd6..3dc43fd 100644 --- a/overrides/override-a1.txt +++ b/overrides/override-a1.txt @@ -156,6 +156,11 @@ remarks: (Rogue) VPN provider is-anonymous-proxy: yes country: EU +aut-num: AS209854 +descr: Surfshark Ltd. +remarks: VPN provider +is-anonymous-proxy: yes + aut-num: AS210083 descr: Privex Inc. remarks: VPN and Tor relay provider diff --git a/overrides/override-a2.txt b/overrides/override-a2.txt index cd4807e..b92f408 100644 --- a/overrides/override-a2.txt +++ b/overrides/override-a2.txt @@ -17,6 +17,16 @@ descr: Speedcast Communications, Inc. remarks: Satellite Internet provider is-satellite-provider: yes +aut-num: AS5377 +descr: Marlink AS +remarks: Satellite Internet provider [high confidence, but not proofed] +is-satellite-provider: yes + +aut-num: AS6621 +descr: Hughes Network Systems +remarks: Satellite Internet provider [several satellite dial-in pools] +is-satellite-provider: yes + aut-num: AS7058 descr: ViaSat, Inc. remarks: Satellite Internet provider @@ -32,11 +42,6 @@ descr: ViaSat, Inc. remarks: Satellite Internet provider is-satellite-provider: yes -aut-num: AS16491 -descr: ViaSat, Inc. -remarks: Satellite Internet provider [several satellite dial-in pools] -is-satellite-provider: yes - aut-num: AS5666 descr: Speedcast Communications, Inc. remarks: Satellite Internet provider @@ -57,6 +62,16 @@ descr: the Tennessean, a division of Gannett Satellite Information Network, remarks: Satellite Internet provider is-satellite-provider: yes +aut-num: AS11902 +descr: World-Link Communications, Inc. +remarks: Satellite Internet provider +is-satellite-provider: yes + +aut-num: AS12440 +descr: Hughes Network Systems GmbH +remarks: Satellite Internet provider +is-satellite-provider: yes + aut-num: AS12491 descr: Gitlat Satcom remarks: Satellite Internet provider @@ -77,6 +92,21 @@ descr: Signalhorn Trusted Networks GmbH / Satlynx remarks: Satellite Internet provider is-satellite-provider: yes +aut-num: AS16491 +descr: ViaSat, Inc. +remarks: Satellite Internet provider [several satellite dial-in pools] +is-satellite-provider: yes + +aut-num: AS17458 +descr: Sure (Diego Garcia) Limited +remarks: Satellite Internet provider [high confidence, but not proofed] +is-satellite-provider: yes + +aut-num: AS17648 +descr: Hughes Communications India Private Limited +remarks: Satellite Internet provider +is-satellite-provider: yes + aut-num: AS18477 descr: G2 Satellite Solutions Corporation remarks: Satellite Internet provider @@ -102,6 +132,11 @@ descr: Intelsat Global Service Corporation remarks: Satellite Internet provider is-satellite-provider: yes +aut-num: AS23652 +descr: XLR8 +remarks: Satellite Internet provider [high confidence, but not proofed] +is-satellite-provider: yes + aut-num: AS25222 descr: Inmarsat Solutions B.V. remarks: Satellite Internet provider @@ -182,6 +217,21 @@ descr: SatTel Corporation, Ltd. remarks: Satellite Internet provider is-satellite-provider: yes +aut-num: AS37406 +descr: RCS-Communication +remarks: Satellite Internet provider +is-satellite-provider: yes + +aut-num: AS37414 +descr: Microcom Sprl +remarks: Satellite Internet provider +is-satellite-provider: yes + +aut-num: AS38009 +descr: Telikom PNG Satellite +remarks: Satellite Internet provider +is-satellite-provider: yes + aut-num: AS39102 descr: SatTel Corporation, Ltd. remarks: Satellite Internet provider @@ -318,6 +368,11 @@ descr: IPStar remarks: Satellite Internet provider [high confidence, but not proofed] is-satellite-provider: yes +aut-num: AS136940 +descr: ComSat Ltd. +remarks: Satellite Internet provider +is-satellite-provider: yes + aut-num: AS139034 descr: Sattelite Plus Incorporated remarks: Satellite Internet provider @@ -353,6 +408,11 @@ descr: Matooma SAS remarks: Satellite Internet provider is-satellite-provider: yes +aut-num: AS204649 +descr: Sure South Atlantic Limited +remarks: Satellite Internet provider +is-satellite-provider: yes + aut-num: AS206283 descr: YahClick / Star Satellite Communications Company - PJSC remarks: Satellite Internet provider @@ -363,6 +423,21 @@ descr: ALCON TELECOM LTD remarks: Satellite Internet provider is-satellite-provider: yes +aut-num: AS265705 +descr: HUGHES DE COLOMBIA S.A.S. +remarks: Satellite Internet provider +is-satellite-provider: yes + +aut-num: AS327870 +descr: Global Broadband Solution +remarks: Satellite Internet provider [high confidence, but not proofed] +is-satellite-provider: yes + +aut-num: AS328121 +descr: Atlantic Future Technology Niger +remarks: Satellite Internet provider [high confidence, but not proofed] +is-satellite-provider: yes + aut-num: AS393582 descr: VIDEO DIRECT SATELLITE & ENTERTAINMENT / WisperISP remarks: Satellite Internet provider @@ -1368,6 +1443,11 @@ descr: Satellite Solutions Worldwide Ltd remarks: Satellite Internet provider is-satellite-provider: yes +net: 185.25.211.0/24 +descr: Liquid Telecom VSAT Network +remarks: Satellite Internet provider +is-satellite-provider: yes + net: 185.27.248.0/22 descr: HDI Group Cooperatief U.A. remarks: Satellite Internet provider [high confidence, but not proofed] @@ -1493,6 +1573,11 @@ descr: Arab Satellite Communications Organization remarks: Satellite Internet provider is-satellite-provider: yes +net: 186.1.128.0/19 +descr: HUGHES DE COLOMBIA S.A.S. +remarks: Satellite Internet provider +is-satellite-provider: yes + net: 186.208.32.0/20 descr: CapRock Comunicacoes do Brasil Ltda remarks: Satellite Internet provider @@ -1613,6 +1698,11 @@ descr: SPEEDCAST Limited remarks: Satellite Internet provider is-satellite-provider: yes +net: 203.16.25.0/24 +descr: Hughes Communications Inc. +remarks: Satellite Internet provider +is-satellite-provider: yes + net: 203.88.64.0/19 descr: SPEEDCAST Limited remarks: Satellite Internet provider @@ -1628,6 +1718,11 @@ descr: Indian Ocean Territories Telecom Pty Ltd remarks: Satellite Internet provider is-satellite-provider: yes +net: 204.115.0.0/22 +descr: Hughes Communications Inc. +remarks: Satellite Internet provider +is-satellite-provider: yes + net: 208.25.12.0/24 descr: Iridium North America remarks: Satellite Internet provider diff --git a/overrides/override-other.txt b/overrides/override-other.txt index 7fe50db..30ac0db 100644 --- a/overrides/override-other.txt +++ b/overrides/override-other.txt @@ -113,6 +113,11 @@ descr: Cloud Management LLC remarks: tampers with RIR data, traces back to HK country: HK +aut-num: AS44477 +descr: IP Oleinichenko Denis +remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage +country: RU + aut-num: AS48090 descr: PPTECHNOLOGY LIMITED remarks: bulletproof ISP (related to AS204655) located in NL @@ -208,6 +213,11 @@ descr: AVATEL TELECOM remarks: ISP located in ES, but some RIR data for announced prefixes contain garbage country: ES +aut-num: AS201118 +descr: Intelcom Group Ltd. +remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage +country: RU + aut-num: AS201133 descr: Verdina Ltd. remarks: ISP located in BG, but RIR data for announced prefixes contain garbage @@ -228,6 +238,11 @@ descr: SILVERHILL GROUP HOLDING LTD / SAKIS POLUNIGIS remarks: fake offshore location (SC), traces back to NL country: NL +aut-num: AS202769 +descr: Cooperative Investments LLC +remarks: bulletproof ISP and IP hijacker, related to AS202425 and AS62355, traces to NL +country: NL + aut-num: AS204655 descr: Novogara Ltd. remarks: bulletproof ISP (strongly linked to AS202425) located in NL @@ -288,6 +303,11 @@ descr: Sun Network Company Limited remarks: IP hijacker, traces back to AP region country: AP +aut-num: AS328671 +descr: Datapacket Maroc SARL +remarks: bulletproof ISP (strongly linked to AS202425) located in NL +country: NL + aut-num: AS398478 descr: PEG TECH INC remarks: ISP located in HK, tampers with RIR data @@ -403,6 +423,11 @@ descr: Datashield, Inc. remarks: fake offshore location (SC), traces back to NL country: NL +net: 185.85.120.0/22 +descr: Intelcom Group Ltd +remarks: fake offshore location (SC), traces back to RU +country: RU + net: 185.140.204.0/22 descr: Hornetsecurity GmbH remarks: all suballocations are used in DE, but are assigned to US -- 2.26.2

1 0

[PATCH] overrides-*: regular batch of overrides
by Peter Müller 13 Jan '21

13 Jan '21

Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- overrides/override-a1.txt | 31 ++++++++++++++++++++++++++++++- overrides/override-a2.txt | 20 ++++++++++++++++++++ overrides/override-a3.txt | 10 ++++++++++ overrides/override-other.txt | 24 ++++++++++++++++++++++-- 4 files changed, 82 insertions(+), 3 deletions(-) diff --git a/overrides/override-a1.txt b/overrides/override-a1.txt index 91bf3b3..6f04bd6 100644 --- a/overrides/override-a1.txt +++ b/overrides/override-a1.txt @@ -138,6 +138,12 @@ descr: Foundation for Applied Privacy remarks: Tor relay provider is-anonymous-proxy: yes +aut-num: AS213005 +descr: Proxyseo Ltd. +remarks: VPN provider located in ES +is-anonymous-proxy: yes +country: ES + aut-num: AS208476 descr: Danilenko, Artyom remarks: (Rogue) VPN provider @@ -646,6 +652,11 @@ descr: Azimut-R VPN Service remarks: VPN provider is-anonymous-proxy: yes +net: 95.140.81.0/24 +descr: Electron telecom VPN Users +remarks: VPN provider +is-anonymous-proxy: yes + net: 95.154.64.0/18 descr: Octopusnet VPN remarks: VPN provider @@ -1018,6 +1029,12 @@ descr: OVPN Integritet AB remarks: VPN provider is-anonymous-proxy: yes +net: 185.162.88.0/24 +descr: Freedom of Speech VPN / nVPN / David Craig / ... +remarks: (Rogue) VPN provider +is-anonymous-proxy: yes +country: EU + net: 185.165.153.0/24 descr: Privacy Matters VPN service / nVPN / David Craig remarks: (Rogue) VPN provider @@ -1028,6 +1045,12 @@ descr: ACQUESPA-VPN remarks: VPN provider is-anonymous-proxy: yes +net: 185.174.40.0/24 +descr: Freedom of Speech VPN / nVPN / David Craig / ... +remarks: (Rogue) VPN provider +is-anonymous-proxy: yes +country: EU + net: 185.198.240.0/24 descr: VPN Consumer Network Services remarks: VPN provider @@ -1038,6 +1061,12 @@ descr: Zwiebelfreunde e.V. / F3 Netze e.V. / The Calyx Institute remarks: Tor relay provider is-anonymous-proxy: yes +net: 185.231.113.0/24 +descr: Freedom of Speech VPN / nVPN / David Craig / ... +remarks: (Rogue) VPN provider +is-anonymous-proxy: yes +country: EU + net: 185.232.143.0/24 descr: VKVPN remarks: VPN provider @@ -1050,7 +1079,7 @@ is-anonymous-proxy: yes net: 185.244.29.0/24 descr: NINAZU VPN Service / Gerber EDV / David Craig -remarks: (Rogue VPN provider), fake location (SC), traces back to NL +remarks: (Rogue) VPN provider, fake location (SC), traces back to NL is-anonymous-proxy: yes country: NL diff --git a/overrides/override-a2.txt b/overrides/override-a2.txt index ffc0303..cd4807e 100644 --- a/overrides/override-a2.txt +++ b/overrides/override-a2.txt @@ -328,6 +328,21 @@ descr: Alpha Sattelite Network remarks: Satellite Internet provider is-satellite-provider: yes +aut-num: AS198381 +descr: YahClick / Star Satellite Communications Company - PJSC +remarks: Satellite Internet provider +is-satellite-provider: yes + +aut-num: AS198394 +descr: YahClick / Star Satellite Communications Company - PJSC +remarks: Satellite Internet provider +is-satellite-provider: yes + +aut-num: AS198504 +descr: YahClick / Star Satellite Communications Company - PJSC +remarks: Satellite Internet provider +is-satellite-provider: yes + aut-num: AS201554 descr: SES Germany GmbH remarks: Satellite Internet provider @@ -338,6 +353,11 @@ descr: Matooma SAS remarks: Satellite Internet provider is-satellite-provider: yes +aut-num: AS206283 +descr: YahClick / Star Satellite Communications Company - PJSC +remarks: Satellite Internet provider +is-satellite-provider: yes + aut-num: AS208756 descr: ALCON TELECOM LTD remarks: Satellite Internet provider diff --git a/overrides/override-a3.txt b/overrides/override-a3.txt index 381ffbe..136b678 100644 --- a/overrides/override-a3.txt +++ b/overrides/override-a3.txt @@ -1020,6 +1020,16 @@ descr: XINDI Networks SRL remarks: Generic anycast network is-anycast: yes +net: 185.174.42.0/24 +descr: SquareFlow / ENAXIM +remarks: Generic anycast network +is-anycast: yes + +net: 185.174.43.0/24 +descr: SquareFlow / ENAXIM / DarkData LLC +remarks: Generic anycast network [high confidence, but not proofed] +is-anycast: yes + net: 185.177.217.0/24 descr: Adman LLC remarks: Generic anycast network diff --git a/overrides/override-other.txt b/overrides/override-other.txt index 1bd3c2a..7fe50db 100644 --- a/overrides/override-other.txt +++ b/overrides/override-other.txt @@ -65,7 +65,7 @@ country: BG aut-num: AS35251 descr: NetLab -remarks: tampers with RIR data, most probabyl located in HK +remarks: tampers with RIR data, most probably located in HK country: HK aut-num: AS35478 @@ -88,6 +88,11 @@ descr: Confluence Networks Inc. remarks: fake offshore location (VG), traces back to Austin, TX, US country: US +aut-num: AS41466 +descr: Treidinvest LLC +remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage +country: RU + aut-num: AS42397 descr: Bunea TELECOM SRL remarks: ISP located in RO, but some RIR data for announced prefixes contain garbage @@ -153,9 +158,14 @@ descr: FOP Gubina Lubov Petrivna remarks: bulletproof ISP operating from a war zone in eastern UA country: UA +aut-num: AS59580 +descr: Batterflyai Media Ltd. +remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage +country: RU + aut-num: AS62355 descr: Network Dedicated SAS -remarks: bulletproof ISP, claims to be located in CH, but traces to NL +remarks: bulletproof ISP and IP hijacker, claims to be located in CH, but traces to NL country: NL aut-num: AS62468 @@ -223,6 +233,16 @@ descr: Novogara Ltd. remarks: bulletproof ISP (strongly linked to AS202425) located in NL country: NL +aut-num: AS205026 +descr: Hauer Hosting Services Limited +remarks: ISP located in ES, but some RIR data for announced prefixes contain garbage +country: ES + +aut-num: AS207046 +descr: Xtudio Networks S.L.U. +remarks: ISP located in ES, but some RIR data for announced prefixes contain garbage +country: ES + aut-num: AS207616 descr: Altrosky Technology Ltd. remarks: fake offshore location (SC), traces back to CZ and NL -- 2.26.2

1 0

[PATCH] overrides-{a3,other}: regular batch of overrides
by Peter Müller 07 Jan '21

07 Jan '21

This time, we primarily correct locataion data for "Datashield, Inc." networks... Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- overrides/override-a3.txt | 5 +++++ overrides/override-other.txt | 30 ++++++++++++++++++++++++++++++ 2 files changed, 35 insertions(+) diff --git a/overrides/override-a3.txt b/overrides/override-a3.txt index 1112e6d..381ffbe 100644 --- a/overrides/override-a3.txt +++ b/overrides/override-a3.txt @@ -1557,6 +1557,11 @@ descr: xTom / dns.sb remarks: Public anycast DNS resolver is-anycast: yes +net: 2a04:ff00:402::/48 +descr: Zeimudo Networks +remarks: Generic anycast network +is-anycast: yes + net: 2a0c:3800:ff::/48 descr: Jean-Remy Buchs remarks: Generic anycast network diff --git a/overrides/override-other.txt b/overrides/override-other.txt index ef1e779..1bd3c2a 100644 --- a/overrides/override-other.txt +++ b/overrides/override-other.txt @@ -143,6 +143,11 @@ descr: FiberXpress BV remarks: bulletproof ISP (related to AS202425) located in NL country: NL +aut-num: AS58073 +descr: YISP BV +remarks: ISP located in NL, but some RIR data for announced prefixes contain garbage +country: NL + aut-num: AS58271 descr: FOP Gubina Lubov Petrivna remarks: bulletproof ISP operating from a war zone in eastern UA @@ -183,6 +188,11 @@ descr: Wujidun Network Limited remarks: part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to AP region country: AP +aut-num: AS200699 +descr: Datashield, Inc. +remarks: fake offshore location (SC), traces back to NL +country: NL + aut-num: AS200845 descr: AVATEL TELECOM remarks: ISP located in ES, but some RIR data for announced prefixes contain garbage @@ -233,6 +243,11 @@ descr: Alviva Holding Limited remarks: bulletproof ISP operating from a war zone in eastern UA country: UA +aut-num: AS209401 +descr: Gudaev Maxim Amrakhovich +remarks: announcements scatter across various places in EU (DE/CZ/??), but RIR data contain garbage +country: EU + aut-num: AS213058 descr: Private Internet Hosting LTD remarks: bulletproof ISP located in RU @@ -303,6 +318,11 @@ descr: IPv4 Superhub Limited remarks: network owned by an HK company, traces back to HK as well - but is assigned to DE. Nice try... country: HK +net: 45.134.12.0/24 +descr: MS Network LTD +remarks: fake offshore location (SC), traces back to NLm +country: NL + net: 45.134.144.0/22 descr: IPv4 Superhub Limited remarks: same as 45.93.16.0/22 @@ -358,6 +378,11 @@ descr: FlokiNET Ltd. remarks: fake offshore location (SC), traces back to RO country: RO +net: 185.56.80.0/22 +descr: Datashield, Inc. +remarks: fake offshore location (SC), traces back to NL +country: NL + net: 185.140.204.0/22 descr: Hornetsecurity GmbH remarks: all suballocations are used in DE, but are assigned to US @@ -437,3 +462,8 @@ net: 2a05:9f06::/31 descr: Sibyl System LTD remarks: RIR data contain garbage country: NL + +net: 2a06:e80::/29 +descr: Datashield, Inc. +remarks: fake offshore location (SC), traces back to NL +country: NL -- 2.26.2

2 1

2024

2023

2022

2021

2020

2019

2018

2017

Location January 2021