Location August 2021

location@lists.ipfire.org

2 participants
7 discussions

[PATCH] override-{a1,other}: regular batch of various overrides
by Peter Müller 19 Aug '21

19 Aug '21

This one removes networks owned by Cloud Innovation Ltd. from the "anonymous proxy" category, since the majority of them does not appear to host anonymous proxies after all. Same goes for 145.249.104.0/22; all of these are shady areas, however. They might go into an "XD" category one day, since we do not consider routing traffic from and to these is a good idea. At the time of writing, there are still some technical and political (Should libloc become an opinionated database? Where would we cut the line?) issues to be solved. Apart from that, this patch adds some more ASNs hijacking IPv4 space out of Hong Kong in particular and the Asia/Pacific area in general. Given the current situation at AfriNIC (whose IPv4 networks are most affected) and the political environment in this area, cleaning up this dump would be a tricky and tedious task to do. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- overrides/override-a1.txt | 15 ----- overrides/override-other.txt | 105 +++++++++++++++++++++++++++++++++++ 2 files changed, 105 insertions(+), 15 deletions(-) diff --git a/overrides/override-a1.txt b/overrides/override-a1.txt index 7cd0359..b4940b2 100644 --- a/overrides/override-a1.txt +++ b/overrides/override-a1.txt @@ -573,11 +573,6 @@ descr: Express VPN International Ltd remarks: VPN provider is-anonymous-proxy: yes -net: 45.192.0.0/12 -descr: Cloud Innovation Ltd. -remarks: hijacked (?) AFRINIC IP chunk owned by an offshore company, routed to several dirty networks worldwide, cannot tell what is going on here -is-anonymous-proxy: yes - net: 45.220.72.0/22 descr: Low budget VPN service remarks: VPN provider @@ -1053,11 +1048,6 @@ descr: Hurricane VPN remarks: VPN provider is-anonymous-proxy: yes -net: 145.249.104.0/22 -descr: Liberty Services / IP Volume Inc. -remarks: VPN provider [high confidence, but not proofed] -is-anonymous-proxy: yes - net: 154.0.24.0/24 descr: WIFI and PROXY NET / Atlantique Telecom remarks: VPN provider [high confidence, but not proofed] @@ -1069,11 +1059,6 @@ remarks: VPN provider [high confidence, but not proofed] is-anonymous-proxy: yes country: FR -net: 154.192.0.0/11 -descr: Cloud Innovation Ltd. -remarks: hijacked AFRINIC IP chunk, owned by suspicous offshore company, scattered across dirty networks worldwide - not a safe place to go -is-anonymous-proxy: yes - net: 156.0.200.0/22 descr: xTom Limited remarks: ... network operator thinks messing with countries and having an offshore company for it is funny :-/ diff --git a/overrides/override-other.txt b/overrides/override-other.txt index b0ee0ca..2c7caaa 100644 --- a/overrides/override-other.txt +++ b/overrides/override-other.txt @@ -110,6 +110,11 @@ descr: PJSC Rostelecom remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage country: RU +aut-num: AS12679 +descr: Sokolov Dmitry Nikolaevich +remarks: ISP located in RU, but many RIR data for announced prefixes contain garbage +country: RU + aut-num: AS12722 descr: RECONN LLC remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage @@ -134,11 +139,21 @@ descr: KLAYER LLC remarks: part of the "Asline" IP hijacking gang, traces back to AP region country: AP +aut-num: AS18530 +descr: Isomedia, Inc. +remarks: ISP located in US, but some RIR data for announced prefixes contain garbage +country: US + aut-num: AS18779 descr: EGIHosting remarks: ISP located in US, but some RIR data for announced prefixes contain garbage country: US +aut-num: AS207711 +descr: Inteldome Corporation +remarks: ... whose location we are unable to determine precisely, but its definitely not MH :-/ +country: EU + aut-num: AS21100 descr: ITL LLC remarks: ISP headquatered in BG and/or UA, physically located in NL, some RIR data for announced prefixes contain inaccurate data @@ -204,6 +219,11 @@ descr: combahton GmbH remarks: ISP located in DE, but some RIR data for announced prefixes contain garbage country: DE +aut-num: AS30860 +descr: Virtual Systems LLC +remarks: ISP located in UA, but some RIR data for announced prefixes contain garbage +country: UA + aut-num: AS30982 descr: CAFE Informatique et telecommunications (defunct) remarks: spamming bogon located in TG - formerly allocated to CAFE Informatique et telecommunications @@ -234,6 +254,11 @@ descr: IP Interactive UG (haftungsbeschraenkt) remarks: ISP located in BG, but RIR data for announced prefixes contain garbage country: BG +aut-num: AS35196 +descr: Ihor Hosting LLC +remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage +country: RU + aut-num: AS35251 descr: NetLab remarks: tampers with RIR data, most probably located in HK @@ -264,6 +289,11 @@ descr: Silverstar Invest Limited remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage country: RU +aut-num: AS35913 +descr: DediPath LLC +remarks: ISP located in US, but some RIR data for announced prefixes contain garbage +country: US + aut-num: AS37155 descr: NetOne Telecomunicacoes (defunct) remarks: spamming bogon located in or near Luanda, AO - formerly allocated to NetOne Telecomunicacoes @@ -579,6 +609,11 @@ descr: Vault Dweller OU remarks: traceroutes dead-end somewhere in or near RU country: RU +aut-num: AS59796 +descr: Stormwall s.r.o +remarks: appears to scatter across EU at least, RIR data contain garbage, might be an A3 candidate +country: EU + aut-num: AS60144 descr: 3W Infra B.V. remarks: ISP located in NL, but some RIR data for announced prefixes contain garbage @@ -624,6 +659,11 @@ descr: SpectraIP B.V. remarks: bulletproof ISP (linked to AS202425 et al.) located in NL country: NL +aut-num: AS62079 +descr: Ibernap Management S.L. +remarks: traces back to various locations in US +country: US + aut-num: AS62355 descr: Network Dedicated SAS remarks: bulletproof ISP and IP hijacker, claims to be located in CH, but traces to NL @@ -714,11 +754,21 @@ descr: Optix Pakistan (Pvt.) Limited remarks: ISP located in PK, some RIR data for announced prefixes (bogons?) contain garbage country: PK +aut-num: AS136545 +descr: Blue Data Center +remarks: IP hijacker located somewhere in AP area, tampers with RIR data +country: AP + aut-num: AS136800 descr: ICIDC NETWORK remarks: IP hijacker located somehwere in AP, suspected to be part of the "Asline" IP hijacking gang, tampers with RIR data country: AP +aut-num: AS136933 +descr: Gigabitbank Global / Anchnet Asia Limited (?) +remarks: IP hijacker located somewhere in AP area, suspected to be part of the "Asline" IP hijacking gang, tampers with RIR data +country: AP + aut-num: AS136988 descr: Leaseweb Australia Pty. Ltd. remarks: ISP located in AU, some RIR data for announced prefixes contain garbage @@ -729,6 +779,11 @@ descr: Anchnet Asia Limited remarks: IP hijacker located in HK, tampers with RIR data country: HK +aut-num: AS137523 +descr: HONGKONG CLOUD NETWORK TECHNOLOGY CO., LIMITED +remarks: IP hijacker located in AP area, tampers with RIR data +country: AP + aut-num: AS137951 descr: Clayer Limited remarks: part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to AP region @@ -739,6 +794,11 @@ descr: MOACK.Co.LTD remarks: ISP located in KR, some RIR data for announced prefixes contain garbage country: KR +aut-num: AS138303 +descr: Asquare International +remarks: ... which appears to host their stuff solely in US +country: US + aut-num: AS138571 descr: SUPERCLOUDS LIMITED remarks: ISP located in HK, tampers with RIR data @@ -759,6 +819,11 @@ descr: SANREN DATA LIMITED remarks: IP hijacker located somewhere in AP region, tampers with RIR data country: AP +aut-num: AS139646 +descr: HONG KONG Megalayer Technology Co.,Limited +remarks: ISP and/or IP hijacker located in HK, tampers with RIR data +country: HK + aut-num: AS139659 descr: LUCIDACLOUD LIMITED remarks: ISP and/or IP hijacker located in HK, tampers with RIR data @@ -774,6 +839,11 @@ descr: Galaxy Broadband remarks: ISP located in PK, but announces 204.137.128.0/18, which is ARIN space, assigned to "AGIS" / Cogent - odd... country: PK +aut-num: AS140227 +descr: Hong Kong Communications International Co., Limited +remarks: part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to AP region +country: AP + aut-num: AS140733 descr: Wujidun Network Limited remarks: part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to AP region @@ -784,6 +854,11 @@ descr: Full Time Hosting remarks: ISP located in DE, tampers with RIR data country: DE +aut-num: AS141159 +descr: Incomparable(HK)Network Co., Limited +remarks: ISP and/or IP hijacker located in AP area, tampers with RIR data +country: AP + aut-num: AS196682 descr: FLP Kochenov Aleksej Vladislavovich remarks: ISP located in UA, but RIR data for announced prefixes all say EU @@ -914,6 +989,11 @@ descr: AAEX NETWORK TECHNOLOGY LTD remarks: IP hijacker located in HK country: HK +aut-num: AS207461 +descr: Liquid IO +remarks: ISP located in US, but many RIR data for announced prefixes contain garbage +country: US + aut-num: AS207569 descr: Network Management Ltd. remarks: traceroutes dead-end somewhere in or near RU @@ -1004,6 +1084,11 @@ descr: Harry Dowd remarks: ISP located in GB, but RIR data for announced prefixes contain garbage country: GB +aut-num: AS212913 +descr: FOP Hornostay Mykhaylo Ivanovych +remarks: ISP located in RU, but some RIR data are inaccurate (UA) +country: RU + aut-num: AS212477 descr: RoyaleHosting B.V. remarks: ISP located in NL, but RIR data for announced prefixes contain garbage @@ -1054,6 +1139,11 @@ descr: DDOS-GUARD CORP. remarks: fake offshore location (BZ), traces back to RU country: RU +aut-num: AS263744 +descr: Udasha S.A. +remarks: traceroutes dead-end somewhere near NYC, US +country: US + aut-num: AS267784 descr: Flyservers S.A. remarks: ISP located in NL, but RIR data for most announced prefixes contain garbage @@ -1084,6 +1174,11 @@ descr: Leaseweb USA, Inc. remarks: ISP located in Dallas, TX, US, but some RIR data for announced prefixes contain garbage country: US +aut-num: AS395886 +descr: KURUN CLOUD INC +remarks: ISP and/or IP hijacker located in US, some RIR data for announced prefixes contain garbage +country: US + aut-num: AS395954 descr: Leaseweb USA, Inc. remarks: ISP located in US, but some RIR data for announced prefixes contain garbage @@ -1204,6 +1299,11 @@ descr: Vodafone US Inc. remarks: large Vodafone IP chunk used in ES, but assigned by ARIN (inaccurate data) country: ES +net: 80.240.96.0/24 +descr: LLC RusTel +remarks: fake location (RU), traces back to HK +country: HK + net: 85.202.80.0/24 descr: Amarutu Technology Ltd. / KoDDoS / ESecurity remarks: fake offshore location (BZ), traces back to US @@ -1234,6 +1334,11 @@ descr: Petersburg Internet Network Ltd. remarks: RIR data for suballocations contain garbage, they are all located in RU country: RU +net: 92.223.90.0/24 +descr: G-Core Labs S.A. +remarks: fake location (CY), traces back to HK +country: HK + net: 95.181.152.0/21 descr: QWARTA LLC remarks: fake location (US), WHOIS contact and traceroutes point to RU -- 2.26.2

1 0

[PATCH] location-importer.in: Braindead me accidentally forgot a "break" statement
by Peter Müller 11 Aug '21

11 Aug '21

This one apparently went down the drain between these two patches: - https://patchwork.ipfire.org/project/location/patch/20210522125758.28770-1-… - https://patchwork.ipfire.org/project/location/patch/aefd1904-4b38-f5cf-ab1d… Due to other safeguards, the current damage in production is limited to: location=# SELECT * FROM networks WHERE country = 'ZZ'; network | country | original_countries | source --------------------+---------+--------------------+-------- 130.195.64.0/19 | ZZ | {ZZ} | APNIC 130.195.96.0/19 | ZZ | {ZZ} | APNIC 122.252.24.0/21 | ZZ | {ZZ} | APNIC 2406:840:10::/48 | ZZ | {ZZ} | APNIC 2406:840:fd0f::/48 | ZZ | {ZZ} | APNIC (5 rows) Fixes: #12673 Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- src/python/location-importer.in | 1 + 1 file changed, 1 insertion(+) diff --git a/src/python/location-importer.in b/src/python/location-importer.in index bec0b62..da058d3 100644 --- a/src/python/location-importer.in +++ b/src/python/location-importer.in @@ -702,6 +702,7 @@ class CLI(object): if validcountries and invalidcountries: log.warning("Skipping network with bogus countr(y|ies) %s (original countries: %s): %s" % \ (invalidcountries, inetnum.get("country"), inetnum.get("inet6num") or inetnum.get("inetnum"))) + break # Everything is fine here, run INSERT statement... self.db.execute("INSERT INTO _rirdata(network, country, original_countries, source) \ -- 2.26.2

2 3

Fwd: Statement of the Number Resource Organization on Allegations Against AFRINIC
by Peter Müller 08 Aug '21

08 Aug '21

Hello *, this is - um - interesting: https://www.nro.net/statement-of-the-number-resource-organization-on-allega… Thanks, and best regards, Peter Müller

1 0

[PATCH v2] overrides: clarify file contents and policies
by Peter Müller 08 Aug '21

08 Aug '21

This patch updates the disclaimer blocks at the beginning of the override-*.txt files, to be more accurate and helpful to people wishing to propose changes to them. In addition, a remark regarding the A[1-3] country codes has been added. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- overrides/override-a1.txt | 26 ++++++++++++++++---------- overrides/override-a2.txt | 20 ++++++++++++++------ overrides/override-a3.txt | 20 +++++++++++++++----- overrides/override-other.txt | 26 ++++++++++++++++++-------- 4 files changed, 63 insertions(+), 29 deletions(-) diff --git a/overrides/override-a1.txt b/overrides/override-a1.txt index 284c3e8..77d5b08 100644 --- a/overrides/override-a1.txt +++ b/overrides/override-a1.txt @@ -1,19 +1,25 @@ # # override-a1 [.txt] # -# This file contains Autonomous Systems (AS) or IP networks/adresses -# which are - in fact or with a high level of confidence - anonymous -# proxies (special country code: A1). +# This file contains Autonomous Systems and IP networks used - in fact or with reasonable +# confidence - for publicly available services for forwarding traffic anonymously, such as +# VPN providers. # -# Since it does not make sense to assign them to a county, they -# will be flagged as "A1" in the database. +# While their country code set is preserved in libloc - unless utterly bogus -, it does not +# actually make sense to assign these to a distinct country. Therefore, they will be flagged +# as "anonymous proxies" in libloc query results. # -# Although we do not consider them to be bad entirely, they might -# be unwanted in certain scenarios. +# For historical reasons, parts of IPFire's web interface use "A1" as a country code for them. +# This violates ISO 3166, and might be changed to a different country code inside a reserved +# range in the future. # -# Please note only long-living Tor relay providers with static IPs -# are listed here, as the list of all Tor relays will be dynamically -# generated by another script. +# At the moment, major Tor exit relay providers are included here as well. They will be dropped +# from this file in the future, as soon as bug #11754 has been solved and a list of Tor exit +# relays is imported dynamically while compiling the database. +# +# Improvement suggestions are appreciated, please submit them as patches to the location mailing +# list. Refer to https://lists.ipfire.org/mailman/listinfo/location and https://wiki.ipfire.org/devel/contact +# for further information. # # Please keep this file sorted. # diff --git a/overrides/override-a2.txt b/overrides/override-a2.txt index 502948f..223b4df 100644 --- a/overrides/override-a2.txt +++ b/overrides/override-a2.txt @@ -1,13 +1,21 @@ # # override-a2 [.txt] # -# This file contains Autonomous Systems (AS) or IP networks/addresses -# which are - in fact or with a high level of confidence - belonging -# to satellite network providers (special country code: A2). +# This file contains Autonomous Systems and IP networks used - in fact or with reasonable +# confidence - for customers or dial-in pools of satellite-based internet services. # -# Since a satellite uplink connection is possible from almost -# anywhere in the world, it does not make sense to assign them to a -# specific country. They will be flagged as "A2" in the database. +# While their country code set is preserved in libloc - unless utterly bogus -, it does not +# actually make sense to assign these to a distinct country, since a satellite connection is +# possible from virtually any place in the world. Therefore, they will be flagged as "satellite +# providers" in libloc query results. +# +# For historical reasons, parts of IPFire's web interface use "A2" as a country code for them. +# This violates ISO 3166, and might be changed to a different country code inside a reserved +# range in the future. +# +# Improvement suggestions are appreciated, please submit them as patches to the location mailing +# list. Refer to https://lists.ipfire.org/mailman/listinfo/location and https://wiki.ipfire.org/devel/contact +# for further information. # # Please keep this file sorted. # diff --git a/overrides/override-a3.txt b/overrides/override-a3.txt index d810d93..b07d4b8 100644 --- a/overrides/override-a3.txt +++ b/overrides/override-a3.txt @@ -1,12 +1,22 @@ # # override-a3 [.txt] # -# This file contains Autonomous Systems (AS) or IP networks/addresses -# which are - in fact or with a high level of confidence - believed -# to be worldwide anycast instances (special country codes: A3). +# This file contains Autonomous Systems and IP networks used - in fact or with reasonable +# confidence - for worldwide anycast services. # -# It does not make sense to assign them to a certain country, they -# will be flagged as "A3" in the database. +# While their country code set is preserved in libloc - unless utterly bogus -, it does not +# make sense to assign these to a distinct country. Therefore, they will be flagged as "anycast" +# in libloc query results. +# +# For historical reasons, parts of IPFire's web interface use "A3" as a country code for them. +# This violates ISO 3166, and might be changed to a different country code inside a reserved +# range in the future. +# +# Improvement suggestions are appreciated, please submit them as patches to the location mailing +# list. Refer to https://lists.ipfire.org/mailman/listinfo/location and https://wiki.ipfire.org/devel/contact +# for further information. +# +# Please keep this file sorted. # aut-num: AS69 diff --git a/overrides/override-other.txt b/overrides/override-other.txt index 045b515..d232fc6 100644 --- a/overrides/override-other.txt +++ b/overrides/override-other.txt @@ -1,14 +1,24 @@ # -# override-other [.txt] +# override-a3 [.txt] # -# This file contains Autonomous Systems (AS) or IP networks/addresses -# whose country information in corresponding RIR data is believed or proven -# to be invalid or inaccurate and which do not match to one of the special categories -# A[1-3]. +# This file contains Autonomous Systems and IP networks whose RIR data are believed to be inaccurate, +# incomplete, or bogus on purpose and by chance. A small subset of its entries applies to AS descriptions, +# while the majority covers country code assignments. # -# Such networks might be legitimate (poorly maintained WHOIS data), shady -# (networks owned by letterbox companies in offshore jurisdictions) or -# hostile (faked RIR data in order to bypass location-based filtering). +# The latter are crucial due to location-based firewalling or routing. Inaccurate country code assignments +# therefore pose a security threat to these users, especially if being set intentionally to circumvent such +# filters. +# +# The term "Location" may refer to the actual, physical location of a network (usually hard to enumerate +# beyond a country-level), or its jurisdiction. To the best of our knowledge, the contents of "country"-fields +# in RIR databases were never clarified in this conext. +# +# When in doubt, the physical location of a network will be used below, especially if the jurisdiction of a +# network appears to be not helpful at all, such as offshore letterbox companies on the other end of the world. +# +# Improvement suggestions are appreciated, please submit them as patches to the location mailing +# list. Refer to https://lists.ipfire.org/mailman/listinfo/location and https://wiki.ipfire.org/devel/contact +# for further information. # # Please keep this file sorted. # -- 2.26.2

1 0

[PATCH] override-*: another bunch of various overrides
by Peter Müller 08 Aug '21

08 Aug '21

Including fixed statements for ASNs without a sane AS name in RIR DBs. My fault, again. :-/ Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- overrides/override-a1.txt | 10 +++ overrides/override-a2.txt | 24 +++++++ overrides/override-a3.txt | 15 ++++ overrides/override-other.txt | 132 ++++++++++++++++++++++++++++++++--- 4 files changed, 170 insertions(+), 11 deletions(-) diff --git a/overrides/override-a1.txt b/overrides/override-a1.txt index 284c3e8..d545f05 100644 --- a/overrides/override-a1.txt +++ b/overrides/override-a1.txt @@ -301,6 +301,11 @@ descr: HardenedVPN[.]com LLC remarks: VPN provider is-anonymous-proxy: yes +aut-num: AS399928 +descr: STELLAR PROXIES +remarks: VPN or open proxy provider +is-anonymous-proxy: yes + net: 2.57.171.0/24 descr: VPN Consumer Network remarks: VPN provider @@ -812,6 +817,11 @@ descr: ThinkTech Technology Industrial CO. Limited remarks: VPN provider is-anonymous-proxy: yes +net: 91.109.176.0/20 +descr: IELO-LIAZO SERVICES SAS +remarks: (Rogue) VPN provider hosting C&Cs en masse +is-anonymous-proxy: yes + net: 91.193.75.0/24 descr: KGB Hosting d.o.o. / David Craig remarks: (Rogue) VPN provider diff --git a/overrides/override-a2.txt b/overrides/override-a2.txt index 502948f..5d28cd8 100644 --- a/overrides/override-a2.txt +++ b/overrides/override-a2.txt @@ -403,6 +403,12 @@ descr: IPStar remarks: Satellite Internet provider [high confidence, but not proofed] is-satellite-provider: yes +aut-num: AS136796 +descr: CoreLink Japan +remarks: Satellite Internet provider [high confidence, but not proofed] located in JP +is-satellite-provider: yes +country: JP + aut-num: AS136940 descr: ComSat Ltd. remarks: Satellite Internet provider @@ -418,6 +424,12 @@ descr: Alpha Sattelite Network remarks: Satellite Internet provider is-satellite-provider: yes +aut-num: AS198247 +descr: YahClick / Star Satellite Communications Company - PJSC +remarks: Satellite Internet provider, RIR data indicates prefixes are hosted in Abu Dhabi, AE +is-satellite-provider: yes +country: AE + aut-num: AS198381 descr: YahClick / Star Satellite Communications Company - PJSC remarks: Satellite Internet provider, RIR data indicates prefixes are hosted in ES @@ -461,6 +473,12 @@ descr: Intersat Telekomunikacije d.o.o. remarks: Satellite Internet provider is-satellite-provider: yes +aut-num: AS208428 +descr: YahClick / Star Satellite Communications Company - PJSC +remarks: Satellite Internet provider, pinning to AE since other announcements made by this organisation contain garbage +is-satellite-provider: yes +country: AE + aut-num: AS208484 descr: EuroSkyPark GmbH remarks: Satellite Internet provider @@ -1626,6 +1644,12 @@ descr: Satellite Ltd remarks: Satellite Internet provider is-satellite-provider: yes +net: 185.192.56.0/22 +descr: CoreLink Communications +remarks: Chinese satellite Internet provider [high confidence, but not proofed] +is-satellite-provider: yes +country: AP + net: 185.200.224.0/22 descr: Level421 GmbH remarks: Satellite Internet provider diff --git a/overrides/override-a3.txt b/overrides/override-a3.txt index d810d93..8cd49a3 100644 --- a/overrides/override-a3.txt +++ b/overrides/override-a3.txt @@ -140,6 +140,11 @@ descr: ANEXIA Internetdienstleistungs GmbH remarks: Public anycast DNS nameserver network [high confidence, but not proofed] is-anycast: yes +aut-num: AS42909 +descr: Community DNS Limited +remarks: Public anycast DNS nameserver network [high confidence, but not proofed] +is-anycast: yes + aut-num: AS43278 descr: Instance Group LLC remarks: Generic anycast network [high confidence, but not proofed], RIR data contain garbage @@ -968,6 +973,16 @@ descr: Communications Regulatory Authority remarks: Generic anycast network is-anycast: yes +net: 184.24.0.0/13 +descr: Akamai Technologies, Inc. +remarks: IP chunk in use for providing CDN services worldwide, subnets scatter across various Autonomous Systems +is-anycast: yes + +net: 184.84.0.0/14 +descr: Akamai Technologies, Inc. +remarks: IP chunk in use for providing CDN services worldwide, subnets scatter across various Autonomous Systems +is-anycast: yes + net: 185.20.53.0/24 descr: Exascale Limited remarks: Generic anycast network diff --git a/overrides/override-other.txt b/overrides/override-other.txt index 045b515..2af24ff 100644 --- a/overrides/override-other.txt +++ b/overrides/override-other.txt @@ -14,15 +14,15 @@ # aut-num: AS1739 -as-name: Tampere University of Technology +name: Tampere University of Technology remarks: has no sane AS name set in RIPE DB aut-num: AS1768 -as-name: NCNIC +name: NCNIC remarks: has no sane AS name set in APNIC DB aut-num: AS1769 -as-name: NCNIC +name: NCNIC remarks: has no sane AS name set in APNIC DB aut-num: AS1820 @@ -41,19 +41,24 @@ remarks: ISP (?) located in ZA, but some RIR data for announced prefixes contain country: ZA aut-num: AS4134 -as-name: Chinanet Backbone +name: Chinanet Backbone remarks: has no sane AS name set in APNIC DB aut-num: AS4754 -as-name: Software Technology Park of India +name: Software Technology Park of India remarks: has no sane AS name set in APNIC DB +aut-num: AS4785 +descr: xTom Limited +remarks: ISP located in JP, RIR data for announced prefixes contain garbage +country: JP + aut-num: AS4800 -as-name: Indonesia Network Information Center +name: Indonesia Network Information Center remarks: has no sane AS name set in APNIC DB aut-num: AS4814 -as-name: China169 Beijing Broadband Network +name: China169 Beijing Broadband Network remarks: has no sane AS name set in APNIC DB aut-num: AS4842 @@ -67,7 +72,7 @@ remarks: traces back to an unknown oversea location (HK?), seems to tamper with country: AP aut-num: AS6412 -as-name: Zajil International Telecom Company +name: Zajil International Telecom Company remarks: has no sane AS name set in RIPE DB aut-num: AS7203 @@ -80,6 +85,11 @@ descr: MTS PJSC remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage country: RU +aut-num: AS9312 +descr: xTom Hong Kong Limited +remarks: ISP located in HK, RIR data for announced prefixes contain garbage +country: HK + aut-num: AS12025 descr: Iron Mountain Data Center remarks: ISP located in US, but some RIR data for announced prefixes contain garbage @@ -95,13 +105,18 @@ descr: RECONN LLC remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage country: RU +aut-num: AS13830 +descr: Nexril +remarks: ISP located in US, but some RIR data for announced prefixes contain garbage +country: US + aut-num: AS18013 descr: ASLINE LIMITED remarks: IP hijacker, traces back to AP region country: AP aut-num: AS18185 -as-name: Northern Taiwan Community University +name: Northern Taiwan Community University remarks: has no sane AS name set in APNIC DB aut-num: AS18254 @@ -109,6 +124,11 @@ descr: KLAYER LLC remarks: part of the "Asline" IP hijacking gang, traces back to AP region country: AP +aut-num: AS18779 +descr: EGIHosting +remarks: ISP located in US, but some RIR data for announced prefixes contain garbage +country: US + aut-num: AS21100 descr: ITL LLC remarks: ISP headquatered in BG and/or UA, physically located in NL, some RIR data for announced prefixes contain inaccurate data @@ -119,6 +139,11 @@ descr: DDOSING NETWORK remarks: IP hijacker located somewhere in AP, massively tampers with RIR data country: AP +aut-num: AS23858 +descr: xTom Pty. Ltd. +remarks: ISP located in AU, RIR data for announced prefixes contain garbage +country: AU + aut-num: AS24009 descr: HK UNITE TELECOMMUNICATIONS DEVELOPMENT LIMITED remarks: IP hijacker (?) located in HK, tampers with RIR data @@ -169,11 +194,31 @@ descr: combahton GmbH remarks: ISP located in DE, but some RIR data for announced prefixes contain garbage country: DE +aut-num: AS30982 +descr: CAFE Informatique et telecommunications (defunct) +remarks: spamming bogon located in TG - formerly allocated to CAFE Informatique et telecommunications +country: TG + +aut-num: AS31133 +descr: PJSC MegaFon +remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage +country: RU + +aut-num: AS31732 +descr: Parsun Network Solutions Pty. Ltd. +remarks: Shady ISP located in AU, but some RIR data for announced prefixes contain garbage +country: AU + aut-num: AS34224 descr: Neterra Ltd. remarks: ISP located in BG, but some RIR data for announced prefixes contain garbage country: BG +aut-num: AS34665 +descr: Petersburg Internet Network Ltd. +remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage +country: RU + aut-num: AS35042 descr: IP Interactive UG (haftungsbeschraenkt) remarks: ISP located in BG, but RIR data for announced prefixes contain garbage @@ -214,6 +259,16 @@ descr: NetOne Telecomunicacoes (defunct) remarks: spamming bogon located in or near Luanda, AO - formerly allocated to NetOne Telecomunicacoes country: AO +aut-num: AS37475 +descr: HTT Telecom S.A (defunct) +remarks: spamming bogon located in CM - formerly allocated to HTT Telecom S.A +country: CM + +aut-num: AS37529 +descr: Gestora de Infraestructuras de Telecomunicaciones de Guinea Ecuatorial +remarks: announces bogons out of GQ +country: GQ + aut-num: AS38197 descr: Sun Network (Hong Kong) Limited remarks: ISP located in HK (duh!), but some RIR data for announced prefixes contain garbage @@ -324,6 +379,11 @@ descr: KeonWoo PARK remarks: claims US for its prefixes announced, but traces back to KR country: KR +aut-num: AS45671 +descr: Servers Australia Pty. Ltd. +remarks: ISP located in AU, but some RIR data for announced prefixes contain garbage +country: AU + aut-num: AS45753 descr: Network and Security Solutions Limited remarks: ISP located in HK, but some RIR data for announced prefixes contain garbage @@ -414,6 +474,16 @@ descr: WhiteHat Inc. remarks: tampers with RIR data country: EU +aut-num: AS54600 +descr: PEG TECH INC +remarks: ISP and/or IP hijacker located in US this time, tampers with RIR data +country: US + +aut-num: AS55836 +descr: Reliance Jio Infocomm Limited +remarks: ISP located in IN, but some RIR data for announced prefixes contain garbage +country: IN + aut-num: AS55933 descr: Cloudie Limited remarks: part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to AP region @@ -629,6 +699,11 @@ descr: Cloud Servers Pvt Ltd remarks: ISP located in NL, all RIR data for announced prefixes contain garbage country: NL +aut-num: AS136384 +descr: Optix Pakistan (Pvt.) Limited +remarks: ISP located in PK, some RIR data for announced prefixes (bogons?) contain garbage +country: PK + aut-num: AS136800 descr: ICIDC NETWORK remarks: IP hijacker located somehwere in AP, suspected to be part of the "Asline" IP hijacking gang, tampers with RIR data @@ -651,7 +726,7 @@ country: AP aut-num: AS138195 descr: MOACK.Co.LTD -remarks: ISP located KR in, some RIR data for announced prefixes contain garbage +remarks: ISP located in KR, some RIR data for announced prefixes contain garbage country: KR aut-num: AS138571 @@ -901,7 +976,7 @@ country: NL aut-num: AS211849 descr: Kakharov Orinbassar Maratuly -remarks: ISP located in RU, but RIR data for announced prefixes contain garbage +remarks: ISP and/or IP hijacker located in RU, but RIR data for announced prefixes contain garbage country: RU aut-num: AS211992 @@ -959,6 +1034,11 @@ descr: IP Connect Inc. remarks: fake offshore location (SC), traces back to NL country: NL +aut-num: AS213296 +descr: SIA "Singularity Telecom" +remarks: Shady customer of AS31732 (Parsun Network Solutions Pty. Ltd.) located in AU, RIR data for announced prefixes contain garbage +country: AU + aut-num: AS262254 descr: DDOS-GUARD CORP. remarks: fake offshore location (BZ), traces back to RU @@ -969,6 +1049,11 @@ descr: Flyservers S.A. remarks: ISP located in NL, but RIR data for most announced prefixes contain garbage country: NL +aut-num: AS328383 +descr: xTom Limited +remarks: ISP located in ZA, RIR data for announced prefixes contain garbage +country: ZA + aut-num: AS328543 descr: Sun Network Company Limited remarks: IP hijacker, traces back to AP region @@ -979,6 +1064,11 @@ descr: Datapacket Maroc SARL remarks: bulletproof ISP (strongly linked to AS202425) located in NL country: NL +aut-num: AS394281 +descr: Xhostserver LLC +remarks: shady ISP located in US, some RIR data for announced prefixes contain garbage +country: US + aut-num: AS394380 descr: Leaseweb USA, Inc. remarks: ISP located in Dallas, TX, US, but some RIR data for announced prefixes contain garbage @@ -1149,6 +1239,11 @@ descr: PSINet, Inc. (PSI) / Cogent Communications remarks: Cogent IP range used in Europe, according to ARIN whois ("COGENT-EUROPEAN-OPERATIONS-001") country: EU +net: 156.0.200.0/22 +descr: xTom Limited +remarks: fake offshore locations (AQ / PN / SS), traces back to US +country: US + net: 178.239.20.0/24 descr: Anthony Marshall / Game Hosting Net / FlokiNET Ltd. remarks: fake location (BA), traces back to RO @@ -1249,6 +1344,11 @@ descr: NetConn Services Ltd remarks: APNIC chunk owned by a HK-based company, routed to AP region, but assigned to SC country: AP +net: 2a00:6340:c000::/34 +descr: Openfactory GmbH +remarks: ... who thinks assigning networks to AQ is funny :-/ +country: EU + net: 2402:e940:f00::/48 descr: Wind Cloud Network Technology Co Ltd. remarks: appears to be used out of Tokyo, JP @@ -1274,6 +1374,11 @@ descr: Sibyl System LTD remarks: RIR data contain garbage country: NL +net: 2a06:1281:5::/48 +descr: Alexander Nicholson +remarks: allocated to NO, but actually announced from FR +country: FR + net: 2a06:e80::/29 descr: Datashield, Inc. remarks: fake offshore location (SC), traces back to NL @@ -1284,6 +1389,11 @@ descr: Securebit AG remarks: ... who thinks assigning networks to unpopulated Bouvet Island (BV) is funny :-/ country: CH +net: 2a10:ccc0:3000::/40 +descr: Securebit AG +remarks: ... who thinks assigning networks to unpopulated Bouvet Island (BV) is funny :-/ +country: CH + net: 2a0e:b100:3000::/40 descr: 4b42 UG (haftungsbeschränkt) remarks: ... who thinks assigning networks to unpopulated Bouvet Island (BV) is funny :-/ -- 2.26.2

1 0

[PATCH 1/2] overrides: regular batch of various overrides
by Peter Müller 08 Aug '21

08 Aug '21

This includes sane AS names for some Autonomous Systems whose operators did not set helpful ones in the corresponding RIR DB. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- overrides/override-a2.txt | 9 +++-- overrides/override-a3.txt | 6 ++++ overrides/override-other.txt | 66 +++++++++++++++++++++++++++++++++--- 3 files changed, 73 insertions(+), 8 deletions(-) diff --git a/overrides/override-a2.txt b/overrides/override-a2.txt index 4aac6ea..502948f 100644 --- a/overrides/override-a2.txt +++ b/overrides/override-a2.txt @@ -420,18 +420,21 @@ is-satellite-provider: yes aut-num: AS198381 descr: YahClick / Star Satellite Communications Company - PJSC -remarks: Satellite Internet provider +remarks: Satellite Internet provider, RIR data indicates prefixes are hosted in ES is-satellite-provider: yes +country: ES aut-num: AS198394 descr: YahClick / Star Satellite Communications Company - PJSC -remarks: Satellite Internet provider +remarks: Satellite Internet provider, RIR data indicates prefixes are hosted in GR is-satellite-provider: yes +country: GR aut-num: AS198504 descr: YahClick / Star Satellite Communications Company - PJSC -remarks: Satellite Internet provider +remarks: Satellite Internet provider, RIR data indicates prefixes are hosted in LU is-satellite-provider: yes +country: LU aut-num: AS201554 descr: SES Germany GmbH diff --git a/overrides/override-a3.txt b/overrides/override-a3.txt index 3c38b69..d810d93 100644 --- a/overrides/override-a3.txt +++ b/overrides/override-a3.txt @@ -177,6 +177,12 @@ descr: Hybula B.V. remarks: Generic anycast network is-anycast: yes +aut-num: AS57724 +descr: DDOS-GUARD LTD +remarks: shady CDN, customers massively tampers with RIR data, we cannot trust this network +is-anycast: yes +country: RU + aut-num: AS57926 descr: SafeDNS, Inc. remarks: Public anycast DNS resolver network [high confidence, but not proofed] diff --git a/overrides/override-other.txt b/overrides/override-other.txt index 454d1d5..045b515 100644 --- a/overrides/override-other.txt +++ b/overrides/override-other.txt @@ -13,6 +13,18 @@ # Please keep this file sorted. # +aut-num: AS1739 +as-name: Tampere University of Technology +remarks: has no sane AS name set in RIPE DB + +aut-num: AS1768 +as-name: NCNIC +remarks: has no sane AS name set in APNIC DB + +aut-num: AS1769 +as-name: NCNIC +remarks: has no sane AS name set in APNIC DB + aut-num: AS1820 descr: WNET TELECOM USA Corp. remarks: traces back to various locations in UA, seems to tamper with RIR data @@ -28,6 +40,22 @@ descr: Dimension Data remarks: ISP (?) located in ZA, but some RIR data for announced prefixes contain garbage country: ZA +aut-num: AS4134 +as-name: Chinanet Backbone +remarks: has no sane AS name set in APNIC DB + +aut-num: AS4754 +as-name: Software Technology Park of India +remarks: has no sane AS name set in APNIC DB + +aut-num: AS4800 +as-name: Indonesia Network Information Center +remarks: has no sane AS name set in APNIC DB + +aut-num: AS4814 +as-name: China169 Beijing Broadband Network +remarks: has no sane AS name set in APNIC DB + aut-num: AS4842 descr: Tianhai InfoTech remarks: IP hijacker located somewhere in AP, massively tampers with RIR data @@ -38,6 +66,10 @@ descr: XNNET LLC remarks: traces back to an unknown oversea location (HK?), seems to tamper with RIR data country: AP +aut-num: AS6412 +as-name: Zajil International Telecom Company +remarks: has no sane AS name set in RIPE DB + aut-num: AS7203 descr: Leaseweb USA, Inc. remarks: ISP located in US, but some RIR data for announced prefixes contain garbage @@ -68,6 +100,10 @@ descr: ASLINE LIMITED remarks: IP hijacker, traces back to AP region country: AP +aut-num: AS18185 +as-name: Northern Taiwan Community University +remarks: has no sane AS name set in APNIC DB + aut-num: AS18254 descr: KLAYER LLC remarks: part of the "Asline" IP hijacking gang, traces back to AP region @@ -128,6 +164,11 @@ descr: Leaseweb USA, Inc. remarks: ISP located in US, but some RIR data for announced prefixes contain garbage (BZ) country: US +aut-num: AS30823 +descr: combahton GmbH +remarks: ISP located in DE, but some RIR data for announced prefixes contain garbage +country: DE + aut-num: AS34224 descr: Neterra Ltd. remarks: ISP located in BG, but some RIR data for announced prefixes contain garbage @@ -168,6 +209,11 @@ descr: Silverstar Invest Limited remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage country: RU +aut-num: AS37155 +descr: NetOne Telecomunicacoes (defunct) +remarks: spamming bogon located in or near Luanda, AO - formerly allocated to NetOne Telecomunicacoes +country: AO + aut-num: AS38197 descr: Sun Network (Hong Kong) Limited remarks: ISP located in HK (duh!), but some RIR data for announced prefixes contain garbage @@ -268,6 +314,11 @@ descr: IP Oleinichenko Denis remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage country: RU +aut-num: AS44592 +descr: Skylink Data Center BV +remarks: ISP located in NL, but some RIR data for announced prefixes contain garbage +country: NL + aut-num: AS44992 descr: KeonWoo PARK remarks: claims US for its prefixes announced, but traces back to KR @@ -318,6 +369,11 @@ descr: Selectel remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage country: RU +aut-num: AS49612 +descr: DDoS Guard Ltd. / Cognitive Cloud LLP +remarks: another shady customer or branch of "DDoS Guard Ltd.", jurisdiction is probably RU, but traceroutes dead-end somewhere else in EU +country: EU + aut-num: AS49921 descr: F.I.H. FORMULA INVESTMENT HOUSE CLEARING LIMITED remarks: claims GR for announced prefixes, but traceroutes dead-end somewhere else in EU @@ -388,11 +444,6 @@ descr: FiberXpress BV remarks: bulletproof ISP (related to AS202425) located in NL country: NL -aut-num: AS57724 -descr: DDOS-GUARD LTD -remarks: shady ISP, customers massively tamper with RIR data, we cannot trust this network -country: RU - aut-num: AS57756 descr: Telefonica LLC remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage @@ -643,6 +694,11 @@ descr: Wujidun Network Limited remarks: part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to AP region country: AP +aut-num: AS140941 +descr: Full Time Hosting +remarks: ISP located in DE, tampers with RIR data +country: DE + aut-num: AS196682 descr: FLP Kochenov Aleksej Vladislavovich remarks: ISP located in UA, but RIR data for announced prefixes all say EU -- 2.26.2

2 3

[PATCH] location-importer.in: Attempt to provide meaningful AS names if organisation handles are missing
by Peter Müller 05 Aug '21

05 Aug '21

A decent amount of autnum objects - especially, but not exclusively in the APNIC sector - does not contain a link to an organisation handle. In such cases, this patch is going to use the first description line of the atunum object in question (if available) as a string for its name. The overwhelming majority of affected ASNs contains a valuable information there, so this is almost as good as having an organisation handle linked to it. Fixes: #12660 Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- src/python/location-importer.in | 28 +++++++++++++++++++++++++--- 1 file changed, 25 insertions(+), 3 deletions(-) diff --git a/src/python/location-importer.in b/src/python/location-importer.in index d4b0ca2..bec0b62 100644 --- a/src/python/location-importer.in +++ b/src/python/location-importer.in @@ -393,11 +393,11 @@ class CLI(object): with self.db.transaction(): # Create some temporary tables to store parsed data self.db.execute(""" - CREATE TEMPORARY TABLE _autnums(number integer, organization text, source text NOT NULL) + CREATE TEMPORARY TABLE _autnums(number integer NOT NULL, organization text NOT NULL, source text NOT NULL) ON COMMIT DROP; CREATE UNIQUE INDEX _autnums_number ON _autnums(number); - CREATE TEMPORARY TABLE _organizations(handle text, name text NOT NULL, source text NOT NULL) + CREATE TEMPORARY TABLE _organizations(handle text NOT NULL, name text NOT NULL, source text NOT NULL) ON COMMIT DROP; CREATE UNIQUE INDEX _organizations_handle ON _organizations(handle); @@ -604,10 +604,32 @@ class CLI(object): elif key == "org": autnum[key] = val.upper() + elif key == "descr": + # Save the first description line as well... + if not key in autnum: + autnum[key] = val + # Skip empty objects - if not autnum: + if not autnum or not "asn" in autnum: return + # Insert a dummy organisation handle into our temporary organisations + # table in case the AS does not have an organisation handle set, but + # has a description (a quirk often observed in APNIC area), so we can + # later display at least some string for this AS. + if not "org" in autnum: + if "descr" in autnum: + autnum["org"] = "LIBLOC-%s-ORGHANDLE" % autnum.get("asn") + + self.db.execute("INSERT INTO _organizations(handle, name, source) \ + VALUES(%s, %s, %s) ON CONFLICT (handle) DO NOTHING", + autnum.get("org"), autnum.get("descr"), source_key, + ) + else: + log.warning("ASN %s neither has an organisation handle nor a description line set, omitting" % \ + autnum.get("asn")) + return + # Insert into database self.db.execute("INSERT INTO _autnums(number, organization, source) \ VALUES(%s, %s, %s) ON CONFLICT (number) DO UPDATE SET \ -- 2.20.1

2 5

2024

2023

2022

2021

2020

2019

2018

2017

Location August 2021