Location March 2021

location@lists.ipfire.org

4 participants
8 discussions

[PATCH v2] location-importer.in: skip networks with unknown country codes
by Peter Müller 04 Apr '21

04 Apr '21

There is no sense in parsing and storting networks whose country codes cannot be found in the ISO-3166-x country code table. This avoids side effects in applications using the location database, and introduces another sanity check to compensate bogus RIR data. On location02, this affects some networks from APNIC (country code: ZZ) as well as a bunch of smaller allocations within the RIPE region still tagged to CS or YU (Yugoslavia). To my surprise, no network tagged as SU (Soviet Union) was found - while the NIC for .su TLD is still operational. :-) Applying this patch causes the countries to be processed before update_whois() is called. In case no countries are present in the SQL table, this check is silently omitted. Fixes: #12510 Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- src/python/location-importer.in | 38 ++++++++++++++++++++++----------- 1 file changed, 26 insertions(+), 12 deletions(-) diff --git a/src/python/location-importer.in b/src/python/location-importer.in index e2f201b..1e08458 100644 --- a/src/python/location-importer.in +++ b/src/python/location-importer.in @@ -388,10 +388,17 @@ class CLI(object): TRUNCATE TABLE networks; """) + # Fetch all valid country codes to check parsed networks aganist... + rows = self.db.query("SELECT * FROM countries ORDER BY country_code") + validcountries = [] + + for row in rows: + validcountries.append(row.country_code) + for source in location.importer.WHOIS_SOURCES: with downloader.request(source, return_blocks=True) as f: for block in f: - self._parse_block(block) + self._parse_block(block, validcountries) # Process all parsed networks from every RIR we happen to have access to, # insert the largest network chunks into the networks table immediately... @@ -467,7 +474,7 @@ class CLI(object): # Download data with downloader.request(source) as f: for line in f: - self._parse_line(line) + self._parse_line(line, validcountries) def _check_parsed_network(self, network): """ @@ -532,7 +539,7 @@ class CLI(object): # be suitable for libloc consumption... return True - def _parse_block(self, block): + def _parse_block(self, block, validcountries = None): # Get first line to find out what type of block this is line = block[0] @@ -542,7 +549,7 @@ class CLI(object): # inetnum if line.startswith("inet6num:") or line.startswith("inetnum:"): - return self._parse_inetnum_block(block) + return self._parse_inetnum_block(block, validcountries) # organisation elif line.startswith("organisation:"): @@ -573,7 +580,7 @@ class CLI(object): autnum.get("asn"), autnum.get("org"), ) - def _parse_inetnum_block(self, block): + def _parse_inetnum_block(self, block, validcountries = None): log.debug("Parsing inetnum block:") inetnum = {} @@ -616,10 +623,10 @@ class CLI(object): if not inetnum or not "country" in inetnum: return - # Skip objects with bogus country code 'ZZ' - if inetnum.get("country") == "ZZ": - log.warning("Skipping network with bogus country 'ZZ': %s" % \ - (inetnum.get("inet6num") or inetnum.get("inetnum"))) + # Skip objects with unknown country codes + if validcountries and inetnum.get("country") not in validcountries: + log.warning("Skipping network with bogus country '%s': %s" % \ + (inetnum.get("country"), inetnum.get("inet6num") or inetnum.get("inetnum"))) return # Iterate through all networks enumerated from above, check them for plausibility and insert @@ -652,7 +659,7 @@ class CLI(object): org.get("organisation"), org.get("org-name"), ) - def _parse_line(self, line): + def _parse_line(self, line, validcountries = None): # Skip version line if line.startswith("2"): return @@ -667,8 +674,15 @@ class CLI(object): log.warning("Could not parse line: %s" % line) return - # Skip any lines that are for stats only - if country_code == "*": + # Skip any lines that are for stats only or do not have a country + # code at all (avoids log spam below) + if not country_code or country_code == '*': + return + + # Skip objects with unknown country codes + if validcountries and country_code not in validcountries: + log.warning("Skipping line with bogus country '%s': %s" % \ + (country_code, line)) return if type in ("ipv6", "ipv4"): -- 2.26.2

2 3

[PATCH] location-importer.in: process unaligned IP ranges in RIR data files correctly
by Peter Müller 01 Apr '21

01 Apr '21

The IP range given in an inetnum object apparently not necessarily matches distinct subnet boundaries. As a result, the current attempt to calculate its CIDR mask resulted in faulty subnets not covering the entire IP range. This patch leaves the task of enumerating subnets to the ipaddress module itself, which handles things much more robust. Since the output may contain of several subnets, a list for the inetnum key is necessary as well as a loop over them when conducting the SQL statements. Fixes: #12595 Cc: Michael Tremer <michael.tremer(a)ipfire.org> Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- src/python/location-importer.in | 31 +++++++++++-------------------- 1 file changed, 11 insertions(+), 20 deletions(-) diff --git a/src/python/location-importer.in b/src/python/location-importer.in index 2506925..e2f201b 100644 --- a/src/python/location-importer.in +++ b/src/python/location-importer.in @@ -3,7 +3,7 @@ # # # libloc - A library to determine the location of someone on the Internet # # # -# Copyright (C) 2020 IPFire Development Team <info(a)ipfire.org> # +# Copyright (C) 2020-2021 IPFire Development Team <info(a)ipfire.org> # # # # This library is free software; you can redistribute it and/or # # modify it under the terms of the GNU Lesser General Public # @@ -604,18 +604,10 @@ class CLI(object): log.warning("Could not parse line: %s" % line) return - # Set prefix to default - prefix = 32 - - # Count number of addresses in this subnet - num_addresses = int(end_address) - int(start_address) - if num_addresses: - prefix -= math.log(num_addresses, 2) - - inetnum["inetnum"] = "%s/%.0f" % (start_address, prefix) + inetnum["inetnum"] = list(ipaddress.summarize_address_range(start_address, end_address)) elif key == "inet6num": - inetnum[key] = val + inetnum[key] = [ipaddress.ip_network(val, strict=False)] elif key == "country": inetnum[key] = val.upper() @@ -630,15 +622,14 @@ class CLI(object): (inetnum.get("inet6num") or inetnum.get("inetnum"))) return - network = ipaddress.ip_network(inetnum.get("inet6num") or inetnum.get("inetnum"), strict=False) - - if not self._check_parsed_network(network): - return - - self.db.execute("INSERT INTO _rirdata(network, country) \ - VALUES(%s, %s) ON CONFLICT (network) DO UPDATE SET country = excluded.country", - "%s" % network, inetnum.get("country"), - ) + # Iterate through all networks enumerated from above, check them for plausibility and insert + # them into the database, if _check_parsed_network() succeeded + for single_network in inetnum.get("inet6num") or inetnum.get("inetnum"): + if self._check_parsed_network(single_network): + self.db.execute("INSERT INTO _rirdata(network, country) \ + VALUES(%s, %s) ON CONFLICT (network) DO UPDATE SET country = excluded.country", + "%s" % single_network, inetnum.get("country"), + ) def _parse_org_block(self, block): org = {} -- 2.26.2

2 7

Problem in urllib?
by Gisle Vanem 01 Apr '21

01 Apr '21

I have a problem with he Python-module and downloading a new .db-file. Used as: py -3 location.py --debug update always returns: HTTP GET Request to location.ipfire.org URL: https://location.ipfire.org/databases/1/location.db.xz Headers: If-modified-since: Tue, 30 Mar 2021 04:04:14 GMT User-agent: location/0.9.4 HTTP Response: 410 Headers: date: Tue, 30 Mar 2021 08:32:16 GMT content-length: 282 content-type: text/html; charset=iso-8859-1 strict-transport-security: max-age=31536000; includeSubDomains; preload connection: close https://location.ipfire.org/databases/ reported: HTTP Error 410: Gone Could not download a new database But when using wget or Chrome, the above URL downloads just fine. Maybe there is a problem with urllib in Windows' version of Python 3.6.5? Or it's a server and CA-path problem since my curl says: subject alt name(s) or common name do not match "location.ipfire.org" (but a 'curl -k ..' works). How can I solve this? I've tried several ca-bundle files to no avail. -- --gv

2 4

override entries change network prefix length
by Peter Müller 29 Mar '21

29 Mar '21

Hello Michael, hello location folks (CC'ed), finally having some spare time to spend on ${things}, I thought working on #11754, #12594 and #12595 might be a good idea to improve the results of our location database. :-) Since #11754 and #12594 involve something like automated overrides to fetched RIR data, I recently noticed adding overrides is changing the displayed network length in a "location lookup" output: > [root@maverick ~]# location lookup 176.10.99.192 > 176.10.99.192: > Network : 176.10.99.192/27 > Country : Switzerland > Autonomous System : AS51395 - Datasource AG > Anonymous Proxy : yes 176.10.99.192 is part of 176.10.96.0/19, which is announced as such by AS51395, hence the output is misleading. A better result would be to display the original size of a BGP announcement, adding some flags if needed without stripping down the IP network size to the override. This is a minor issue as far as I am concerned, but before I create code that generates overrides en masse, I would like to discuss whether or not it is a good idea to keep the current behaviour. Thanks, and best regards, Peter Müller

2 1

mem-map leak in loc_database_free()
by Gisle Vanem 22 Mar '21

22 Mar '21

Hello list. In my Windows program I use the 'libloc' library and the compressed 'location.db.xz' file. I also have some functions to download, decompress to a temp-file. Then finally using 'CopyFile()' to update to the final .db-file. But my problem was that 'CopyFile()' failed with error 'ERROR_USER_MAPPED_FILE' since some regions to the file was not closed. I saw that 'libloc' does 5 calls to 'mmap()' but only 4 calls to 'munmap()' in 'loc_database_free()'; the freeing of 'db->countries_v1' is missing. So with this patch my program works fine: --- a/database.c 2020-12-03 15:04:38 +++ b/database.c 2021-03-21 17:21:04 @@ -446,6 +446,13 @@ ERROR(db->ctx, "Could not unmap network nodes section: %s\n", strerror(errno)); } + // Remove mapped countries nodes section + if (db->countries_v1) { + r = munmap(db->countries_v1, db->countries_count * sizeof(*db->countries_v1)); + if (r) + ERROR(db->ctx, "Could not unmap countries nodes section: %s\n", strerror(errno)); + } + if (db->pool) loc_stringpool_unref(db->pool); --------- Not sure how 'libloc' could work w/o this on Linux. What does a 'cp /tmp/location.db location-in-use.db' say when running one of the test programs in parallel? -- --gv

2 1

[PATCH] add overrides for dirty ISP conglomerate "Inter Connects Inc. & friends"
by Peter Müller 20 Mar '21

20 Mar '21

AS owned by a couple of letterbox companies in London (most notably Inter Connects Inc. and Packet Exchange Ltd.) were found to tamper massively with RIR data of prefixes they own or announce. Aside from that, these AS are currently hijacking AfriNIC chunks widely believed as being stolen - plus hosting some cybercrime stuff for good measure. Except for AS63119, all of these networks show strong links to Sweden, while some traceroutes dead-end at other places in Europe. As a consequence, we cannot trust the county information published by this actor, generously overriding them to limit damage to IPFire location database users. The author strongly recommends against accepting any traffic from or to these networks (some of them have ASN-DROP listings at Spamhaus indeed), but this aspect is out of scope for the IPFire location database. Just mentioning it here for the sake of completeness. :-) In addition, this patch features some IPv4 networks apparently operated by VPN providers in US - being shady as well, just saying. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- overrides/override-a1.txt | 20 ++++++++++++++++++++ overrides/override-other.txt | 35 +++++++++++++++++++++++++++++++++++ 2 files changed, 55 insertions(+) diff --git a/overrides/override-a1.txt b/overrides/override-a1.txt index 1ccfa0a..76a5a52 100644 --- a/overrides/override-a1.txt +++ b/overrides/override-a1.txt @@ -297,6 +297,11 @@ descr: CloudVPN Inc. remarks: VPN provider is-anonymous-proxy: yes +net: 23.230.23.0/24 +descr: Colorberry VPN Services +remarks: VPN provider +is-anonymous-proxy: yes + net: 23.239.176.0/22 descr: CloudVPN Inc. remarks: VPN provider @@ -798,6 +803,11 @@ descr: PureVPN remarks: VPN provider is-anonymous-proxy: yes +net: 107.186.38.0/24 +descr: Colorberry VPN services +remarks: VPN provider +is-anonymous-proxy: yes + net: 109.70.100.0/24 descr: Foundation for Applied Privacy remarks: Tor relay provider @@ -853,6 +863,11 @@ descr: GZ Systems Limited / PureVPN remarks: VPN provider is-anonymous-proxy: yes +net: 142.252.111.0/24 +descr: Hurricane VPN +remarks: VPN provider +is-anonymous-proxy: yes + net: 145.249.104.0/22 descr: Liberty Services / IP Volume Inc. remarks: VPN provider [high confidence, but not proofed] @@ -1344,6 +1359,11 @@ descr: VPN Consumer Network Services remarks: VPN provider is-anonymous-proxy: yes +net: 205.164.4.0/24 +descr: OpenVPN Technologies, Inc. +remarks: VPN provider +is-anonymous-proxy: yes + net: 205.185.193.0/24 descr: SecuredConnectivity remarks: VPN provider diff --git a/overrides/override-other.txt b/overrides/override-other.txt index bec4d80..b428d9f 100644 --- a/overrides/override-other.txt +++ b/overrides/override-other.txt @@ -103,6 +103,11 @@ descr: Treidinvest LLC remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage country: RU +aut-num: AS41564 +descr: Packet Exchange Limited +remarks: shady uplink for a bunch of dirty ISPs in SE (and likely elsewhere in EU), routing stolen AfriNIC networks, RIR data of prefixes announced by this AS cannot be trusted +country: EU + aut-num: AS42397 descr: Bunea TELECOM SRL remarks: ISP located in RO, but some RIR data for announced prefixes contain garbage @@ -133,6 +138,11 @@ descr: PPTECHNOLOGY LIMITED remarks: bulletproof ISP (related to AS204655) located in NL country: NL +aut-num: AS41564 +descr: Global Colocation Limited +remarks: part of a dirty ISP conglomerate most likely operating out of SE +country: SE + aut-num: AS49466 descr: KLAYER LLC remarks: part of the "Asline" IP hijacking gang, traces back to AP region @@ -168,6 +178,11 @@ descr: FiberXpress BV remarks: bulletproof ISP (related to AS202425) located in NL country: NL +aut-num: AS57858 +descr: Inter Connects Inc. +remarks: part of a dirty ISP conglomerate operating most likely out of SE, hijacking stolen AfriNIC networks, massively tampers with RIR data +country: SE + aut-num: AS58073 descr: YISP BV remarks: ISP located in NL, but some RIR data for announced prefixes contain garbage @@ -183,6 +198,11 @@ descr: Batterflyai Media Ltd. remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage country: RU +aut-num: AS60485 +descr: Inter Connects Inc. / Jing Yun +remarks: part of a dirty ISP conglomerate operating most likely out of SE, hijacking AfriNIC networks +country: SE + aut-num: AS62355 descr: Network Dedicated SAS remarks: bulletproof ISP and IP hijacker, claims to be located in CH, but traces to NL @@ -193,6 +213,11 @@ descr: VpsQuan L.L.C. remarks: claims to be located in US, but traces to HK country: HK +aut-num: AS63119 +descr: Inter Connects Inc. +remarks: part of a dirty ISP conglomerate, traces back to US this time +country: US + aut-num: AS64437 descr: NForce Entertainment BV remarks: currently hijacks a single stolen /20 AfriNIC IPv4 net, hosted in NL @@ -268,6 +293,11 @@ descr: Kevin Holly trading as Silent Ghost e.U. remarks: AS run by someone who thinks allocating IP networks to AQ is funny (it is not, kid) :-/ country: NL +aut-num: AS204353 +descr: Global Offshore Limited +remarks: part of a dirty ISP conglomerate with links to SE, RIR data of prefixes announced by this AS cannot be trusted +country: EU + aut-num: AS204655 descr: Novogara Ltd. remarks: bulletproof ISP (strongly linked to AS202425) located in NL @@ -343,6 +373,11 @@ descr: PEG TECH INC remarks: ISP located in HK, tampers with RIR data country: HK +aut-num: AS398826 +descr: OLink Cloud LLC +remarks: shady ISP located in US, but some RIR data for announced prefixes contain garbage +country: US + net: 5.1.68.0/24 descr: GaiacomLC remarks: routed to DE, inaccurate RIR data -- 2.20.1

1 0

[PATCH 1/2] Add configure option for fanalyzer
by Jonatan Schlag 06 Mar '21

06 Mar '21

Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- Makefile.am | 3 +- configure.ac | 15 +++++++ m4/warnings.m4 | 110 +++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 127 insertions(+), 1 deletion(-) create mode 100644 m4/warnings.m4 diff --git a/Makefile.am b/Makefile.am index 65e96d7..0c2f78c 100644 --- a/Makefile.am +++ b/Makefile.am @@ -18,7 +18,8 @@ AM_CPPFLAGS = \ -DSYSCONFDIR=\""$(sysconfdir)"\" \ -I${top_srcdir}/src -AM_CFLAGS = ${my_CFLAGS} \ +AM_CFLAGS = ${warn_CFLAGS} \ + ${my_CFLAGS} \ -ffunction-sections \ -fdata-sections diff --git a/configure.ac b/configure.ac index 9eb9012..dd1ca64 100644 --- a/configure.ac +++ b/configure.ac @@ -89,6 +89,21 @@ AC_CHECK_FUNCS([ \ qsort \ ]) + +# - more-warnings -------------------------------------------------------------- + + +warn_CFLAGS="" + +AC_ARG_ENABLE([more_warnings], + AS_HELP_STRING([--enable-more-warnings], [enable more warn messages especially fanalyzer @<:@default=disabled@:>@]), + [more_warnings=yes], [more_warnings=no]) +AS_IF([test "x$more_warnings" = "xyes"],[ + gl_WARN_ADD([-fanalyzer],[warn_CFLAGS]) +]) + +AC_SUBST([warn_CFLAGS]) + my_CFLAGS="\ -Wall \ -Wchar-subscripts \ diff --git a/m4/warnings.m4 b/m4/warnings.m4 new file mode 100644 index 0000000..9e24d89 --- /dev/null +++ b/m4/warnings.m4 @@ -0,0 +1,110 @@ +# warnings.m4 serial 16 +dnl Copyright (C) 2008-2021 Free Software Foundation, Inc. +dnl This file is free software; the Free Software Foundation +dnl gives unlimited permission to copy and/or distribute it, +dnl with or without modifications, as long as this notice is preserved. + +dnl From Simon Josefsson + +# gl_AS_VAR_APPEND(VAR, VALUE) +# ---------------------------- +# Provide the functionality of AS_VAR_APPEND if Autoconf does not have it. +m4_ifdef([AS_VAR_APPEND], +[m4_copy([AS_VAR_APPEND], [gl_AS_VAR_APPEND])], +[m4_define([gl_AS_VAR_APPEND], +[AS_VAR_SET([$1], [AS_VAR_GET([$1])$2])])]) + + +# gl_COMPILER_OPTION_IF(OPTION, [IF-SUPPORTED], [IF-NOT-SUPPORTED], +# [PROGRAM = AC_LANG_PROGRAM()]) +# ----------------------------------------------------------------- +# Check if the compiler supports OPTION when compiling PROGRAM. +# +# The effects of this macro depend on the current language (_AC_LANG). +AC_DEFUN([gl_COMPILER_OPTION_IF], +[ +AS_VAR_PUSHDEF([gl_Warn], [gl_cv_warn_[]_AC_LANG_ABBREV[]_$1])dnl +AS_VAR_PUSHDEF([gl_Flags], [_AC_LANG_PREFIX[]FLAGS])dnl +AS_LITERAL_IF([$1], + [m4_pushdef([gl_Positive], m4_bpatsubst([$1], [^-Wno-], [-W]))], + [gl_positive="$1" +case $gl_positive in + -Wno-*) gl_positive=-W`expr "X$gl_positive" : 'X-Wno-$.*$'` ;; +esac +m4_pushdef([gl_Positive], [$gl_positive])])dnl +AC_CACHE_CHECK([whether _AC_LANG compiler handles $1], [gl_Warn], [ + gl_save_compiler_FLAGS="$gl_Flags" + gl_AS_VAR_APPEND(m4_defn([gl_Flags]), + [" $gl_unknown_warnings_are_errors ]m4_defn([gl_Positive])["]) + AC_LINK_IFELSE([m4_default([$4], [AC_LANG_PROGRAM([[]])])], + [AS_VAR_SET([gl_Warn], [yes])], + [AS_VAR_SET([gl_Warn], [no])]) + gl_Flags="$gl_save_compiler_FLAGS" +]) +AS_VAR_IF(gl_Warn, [yes], [$2], [$3]) +m4_popdef([gl_Positive])dnl +AS_VAR_POPDEF([gl_Flags])dnl +AS_VAR_POPDEF([gl_Warn])dnl +]) + +# gl_UNKNOWN_WARNINGS_ARE_ERRORS +# ------------------------------ +# Clang doesn't complain about unknown warning options unless one also +# specifies -Wunknown-warning-option -Werror. Detect this. +# +# The effects of this macro depend on the current language (_AC_LANG). +AC_DEFUN([gl_UNKNOWN_WARNINGS_ARE_ERRORS], +[_AC_LANG_DISPATCH([$0], _AC_LANG, $@)]) + +# Specialization for _AC_LANG = C. This macro can be AC_REQUIREd. +AC_DEFUN([gl_UNKNOWN_WARNINGS_ARE_ERRORS(C)], +[ + AC_LANG_PUSH([C]) + gl_UNKNOWN_WARNINGS_ARE_ERRORS_IMPL + AC_LANG_POP([C]) +]) + +# Specialization for _AC_LANG = C++. This macro can be AC_REQUIREd. +AC_DEFUN([gl_UNKNOWN_WARNINGS_ARE_ERRORS(C++)], +[ + AC_LANG_PUSH([C++]) + gl_UNKNOWN_WARNINGS_ARE_ERRORS_IMPL + AC_LANG_POP([C++]) +]) + +# Specialization for _AC_LANG = Objective C. This macro can be AC_REQUIREd. +AC_DEFUN([gl_UNKNOWN_WARNINGS_ARE_ERRORS(Objective C)], +[ + AC_LANG_PUSH([Objective C]) + gl_UNKNOWN_WARNINGS_ARE_ERRORS_IMPL + AC_LANG_POP([Objective C]) +]) + +AC_DEFUN([gl_UNKNOWN_WARNINGS_ARE_ERRORS_IMPL], +[gl_COMPILER_OPTION_IF([-Werror -Wunknown-warning-option], + [gl_unknown_warnings_are_errors='-Wunknown-warning-option -Werror'], + [gl_unknown_warnings_are_errors=])]) + +# gl_WARN_ADD(OPTION, [VARIABLE = WARN_CFLAGS/WARN_CXXFLAGS], +# [PROGRAM = AC_LANG_PROGRAM()]) +# ----------------------------------------------------------- +# Adds parameter to WARN_CFLAGS/WARN_CXXFLAGS if the compiler supports it +# when compiling PROGRAM. For example, gl_WARN_ADD([-Wparentheses]). +# +# If VARIABLE is a variable name, AC_SUBST it. +# +# The effects of this macro depend on the current language (_AC_LANG). +AC_DEFUN([gl_WARN_ADD], +[AC_REQUIRE([gl_UNKNOWN_WARNINGS_ARE_ERRORS(]_AC_LANG[)]) +gl_COMPILER_OPTION_IF([$1], + [gl_AS_VAR_APPEND(m4_if([$2], [], [[WARN_]_AC_LANG_PREFIX[FLAGS]], [[$2]]), [" $1"])], + [], + [$3]) +m4_ifval([$2], + [AS_LITERAL_IF([$2], [AC_SUBST([$2])])], + [AC_SUBST([WARN_]_AC_LANG_PREFIX[FLAGS])])dnl +]) + +# Local Variables: +# mode: autoconf +# End: -- 2.30.1

1 2

[PATCH] overrides: regular batch of various overrides
by Peter Müller 05 Mar '21

05 Mar '21

Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- overrides/override-a1.txt | 10 ++++++++++ overrides/override-a2.txt | 15 +++++++++++++++ overrides/override-a3.txt | 5 +++++ overrides/override-other.txt | 25 +++++++++++++++++++++++++ 4 files changed, 55 insertions(+) diff --git a/overrides/override-a1.txt b/overrides/override-a1.txt index a7594bf..1ccfa0a 100644 --- a/overrides/override-a1.txt +++ b/overrides/override-a1.txt @@ -1249,6 +1249,11 @@ descr: Anonymouse / Anonymous S.A. remarks: VPN and open proxy provider is-anonymous-proxy: yes +net: 193.218.190.0/24 +descr: Private Internet Hosting LTD +remarks: VPN provider +is-anonymous-proxy: yes + net: 194.5.96.0/22 descr: Angelo Kreikamp trading as Forhosting / Privacy Online / Danilenko, Artyom / ... remarks: (Rogue) VPN provider @@ -1264,6 +1269,11 @@ descr: NordVPN remarks: VPN provider is-anonymous-proxy: yes +net: 194.87.207.0/24 +descr: Lynx Proxies Ltd. +remarks: VPN provider +is-anonymous-proxy: yes + net: 195.138.249.0/24 descr: Perfect Privacy LTD remarks: VPN provider diff --git a/overrides/override-a2.txt b/overrides/override-a2.txt index b92f408..72d1a1d 100644 --- a/overrides/override-a2.txt +++ b/overrides/override-a2.txt @@ -1508,6 +1508,11 @@ descr: Digitaria International remarks: Satellite Internet provider is-satellite-provider: yes +net: 185.97.148.0/22 +descr: Skylink Networking Ltd +remarks: Satellite Internet provider [high confidence, but not proofed] +is-satellite-provider: yes + net: 185.151.232.0/22 descr: Inmarsat Solutions AS remarks: Satellite Internet provider @@ -1573,6 +1578,11 @@ descr: Arab Satellite Communications Organization remarks: Satellite Internet provider is-satellite-provider: yes +net: 185.237.132.0/22 +descr: Media Broadcast Satellite GmbH +remarks: Satellite Internet provider +is-satellite-provider: yes + net: 186.1.128.0/19 descr: HUGHES DE COLOMBIA S.A.S. remarks: Satellite Internet provider @@ -1993,6 +2003,11 @@ descr: Avanti Broadband Ltd. remarks: Satellite Internet provider is-satellite-provider: yes +net: 2a00:6cc0::/32 +descr: Skylink Networking Ltd +remarks: Satellite Internet provider [high confidence, but not proofed] +is-satellite-provider: yes + net: 2a00:b3a0::/36 descr: PoP0 Address Space / NYNEX satellite OHG remarks: Satellite Internet provider diff --git a/overrides/override-a3.txt b/overrides/override-a3.txt index 136b678..dbf5dd7 100644 --- a/overrides/override-a3.txt +++ b/overrides/override-a3.txt @@ -735,6 +735,11 @@ descr: ProstoDNS remarks: Generic anycast network is-anycast: yes +net: 169.239.202.0/24 +descr: FuslVZ OpenNIC +remarks: Public anycast DNS resolver +is-anycast: yes + net: 170.52.0.0/21 descr: subspace remarks: Generic anycast network [high confidence, but not proofed] diff --git a/overrides/override-other.txt b/overrides/override-other.txt index b34f055..bec4d80 100644 --- a/overrides/override-other.txt +++ b/overrides/override-other.txt @@ -13,6 +13,11 @@ # Please keep this file sorted. # +aut-num: AS3216 +descr: PJSC "Vimpelcom" +remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage +country: RU + aut-num: AS6134 descr: XNNET LLC remarks: traces back to an unknown oversea location (HK?), seems to tamper with RIR data @@ -138,6 +143,11 @@ descr: Selectel remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage country: RU +aut-num: AS49921 +descr: F.I.H. FORMULA INVESTMENT HOUSE CLEARING LIMITED +remarks: claims GR for announced prefixes, but traceroutes dead-end somewhere else in EU +country: EU + aut-num: AS51558 descr: Smart Telecom S.A.R.L remarks: tampers with RIR data, traces back to RU @@ -183,6 +193,11 @@ descr: VpsQuan L.L.C. remarks: claims to be located in US, but traces to HK country: HK +aut-num: AS64437 +descr: NForce Entertainment BV +remarks: currently hijacks a single stolen /20 AfriNIC IPv4 net, hosted in NL +country: NL + aut-num: AS134548 descr: DXTL Tseung Kwan O Service remarks: tampers with RIR data, traces back to AP region @@ -248,6 +263,11 @@ descr: Cooperative Investments LLC remarks: bulletproof ISP and IP hijacker, related to AS202425 and AS62355, traces to NL country: NL +aut-num: AS204136 +descr: Kevin Holly trading as Silent Ghost e.U. +remarks: AS run by someone who thinks allocating IP networks to AQ is funny (it is not, kid) :-/ +country: NL + aut-num: AS204655 descr: Novogara Ltd. remarks: bulletproof ISP (strongly linked to AS202425) located in NL @@ -522,3 +542,8 @@ net: 2a06:e80::/29 descr: Datashield, Inc. remarks: fake offshore location (SC), traces back to NL country: NL + +net: 2a0f:7a80::/29 +descr: ASLINE Limited +remarks: APNIC chunk owned by a HK-based company, but assigned to DE +country: AP -- 2.26.2

1 0

2024

2023

2022

2021

2020

2019

2018

2017

Location March 2021