Location September 2021

location@lists.ipfire.org

5 participants
7 discussions

ASNs without AS name information (LACNIC and JPNIC)
by nusenu 19 Jan '22

19 Jan '22

Hi, I'm currently evaluating whether I should use ipfire or RIPEstat for AS information. (low number of lookups, lookup latency is not an issue) For tor relay IPs I found 54 ASNs where ipfire's DB has no AS name information. These are likely related to LACNIC and JPNIC. Are there plans to add AS names for these regions as well or will this not improve in the near future (before 2022)? kind regards, nusenu +-----------+---------+ | as_number | country | +-----------+---------+ | AS61493 | ar | | AS7303 | ar | | AS18881 | br | | AS19182 | br | | AS262287 | br | | AS264381 | br | | AS267436 | br | | AS268207 | br | | AS269070 | br | | AS27699 | br | | AS27715 | br | | AS28126 | br | | AS28271 | br | | AS28573 | br | | AS28668 | br | | AS53024 | br | | AS53111 | br | | AS53187 | br | | AS7162 | br | | AS7738 | br | | AS8167 | br | | AS22047 | cl | | AS265831 | cl | | AS270013 | cl | | AS27651 | cl | | AS52368 | cl | | AS64111 | cl | | AS7418 | cl | | AS13489 | co | | AS11830 | cr | | AS3790 | cr | | AS52423 | cr | | AS28118 | do | | AS10010 | jp | | AS17676 | jp | | AS18126 | jp | | AS2510 | jp | | AS2514 | jp | | AS2516 | jp | | AS2527 | jp | | AS4685 | jp | | AS4694 | jp | | AS4713 | jp | | AS4725 | jp | | AS59103 | jp | | AS7506 | jp | | AS7684 | jp | | AS9370 | jp | | AS9371 | jp | | AS13999 | mx | | AS278 | mx | | AS6503 | mx | | AS8151 | mx | | AS27956 | pa | +-----------+---------+

3 11

[RFC PATCH] location-importer.in: Add Spamhaus DROP lists
by Peter Müller 30 Sep '21

30 Sep '21

A while ago, it was discussed whether or not libloc should become an "opinionated database", i. e. including any information on a network's reputation. In general, this idea was dismissed as libloc is neither intended nor suitable for such tasks, and we do not want to make (political?) decisions like these for various reasons. All we do is to provide a useful location database in a neutral way, and leave it up to our users on how to react on certain results. However, there is a problematic area. Take AS55303 as an example: We _know_ this is to be a dirty network, tampering with RIR data and hijacking IP space, and strongly recommend against processing any connection originating from or directed to it. Since it appears to be loaded with proxies used by miscreants for abusive purposes, all we can do at the time of writing is to flag it as "anonymous proxy", but we lack possibility of telling our users something like "this is not a safe area". The very same goes for known bulletproof ISPs, IP hijackers, and so forth. This patch therefore suggests to populate the "is_drop" flag introduced in libloc 0.9.8 (albeit currently unused in production) with the contents of Spamhaus' DROP lists (https://www.spamhaus.org/drop/), to have at least the baddest of the bad covered. The very same lists are, in fact, included in popular IPS rulesets as well - a decent amount of IPFire users is therefore likely to have them already enabled, but in a very costly way. It is not planned to go further, partly because there is no other feed publicly available, which would come with the same intention, volatility, and FP rate. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- src/python/location-importer.in | 104 ++++++++++++++++++++++++++++++++ 1 file changed, 104 insertions(+) diff --git a/src/python/location-importer.in b/src/python/location-importer.in index da058d3..0f06465 100644 --- a/src/python/location-importer.in +++ b/src/python/location-importer.in @@ -1059,6 +1059,9 @@ class CLI(object): # network allocation lists in a machine-readable format... self._update_overrides_for_aws() + # Update overrides for Spamhaus DROP feeds... + self._update_overrides_for_spamhaus_drop() + for file in ns.files: log.info("Reading %s..." % file) @@ -1243,6 +1246,107 @@ class CLI(object): ) + def _update_overrides_for_spamhaus_drop(self): + downloader = location.importer.Downloader() + + ip_urls = [ + "https://www.spamhaus.org/drop/drop.txt", + "https://www.spamhaus.org/drop/edrop.txt", + "https://www.spamhaus.org/drop/dropv6.txt" + ] + + asn_urls = [ + "https://www.spamhaus.org/drop/asndrop.txt" + ] + + for url in ip_urls: + try: + with downloader.request(url, return_blocks=False) as f: + fcontent = f.body.readlines() + except Exception as e: + log.error("Unable to download Spamhaus DROP URL %s: %s" % (url, e)) + return + + # Iterate through every line, filter comments and add remaining networks to + # the override table in case they are valid... + with self.db.transaction(): + for sline in fcontent: + + # XXX: Is there a better way to do this? + sline = sline.decode("utf-8") + + # Comments start with a semicolon, followed by a space... + if sline.startswith("; "): + continue + + # Extract network and ignore anything afterwards... + try: + network = ipaddress.ip_network(sline.split()[0], strict=False) + except ValueError: + log.error("Unable to parse line: %s" % sline) + continue + + # Sanitize parsed networks... + if not self._check_parsed_network(network): + log.warning("Skipping bogus network found in Spamhaus DROP URL %s: %s" % \ + (url, network)) + continue + + # Conduct SQL statement... + self.db.execute(""" + INSERT INTO network_overrides( + network, + source, + is_drop + ) VALUES (%s, %s, %s) + ON CONFLICT (network) DO NOTHING""", + "%s" % network, + "Spamhaus DROP lists", + True + ) + + for url in asn_urls: + try: + with downloader.request(url, return_blocks=False) as f: + fcontent = f.body.readlines() + except Exception as e: + log.error("Unable to download Spamhaus DROP URL %s: %s" % (url, e)) + return + + # Iterate through every line, filter comments and add remaining ASNs to + # the override table in case they are valid... + with self.db.transaction(): + for sline in fcontent: + + # XXX: Is there a better way to do this? + sline = sline.decode("utf-8") + + # Comments start with a semicolon, followed by a space... + if sline.startswith("; "): + continue + + # Extract ASN and ignore anything afterwards... + asn = int(sline.split()[0].strip("AS")) + + # Sanitize parsed ASNs... + if not ((1 <= asn and asn <= 23455) or (23457 <= asn and asn <= 64495) or (131072 <= asn and asn <= 4199999999)): + log.warning("Skipping bogus ASN found in Spamhaus DROP URL %s: %s" % \ + (url, asn)) + continue + + # Conduct SQL statement... + self.db.execute(""" + INSERT INTO autnum_overrides( + number, + source, + is_drop + ) VALUES (%s, %s, %s) + ON CONFLICT (number) DO NOTHING""", + "%s" % asn, + "Spamhaus ASN-DROP list", + True + ) + @staticmethod def _parse_bool(block, key): val = block.get(key) -- 2.26.2

2 1

[PATCH] importer.py: Import JPNIC feed as well
by Peter Müller 27 Sep '21

27 Sep '21

This adds names for - at the time of writing - 421 ASNs which were missing before, as JPNIC does not mirror (all) information back to APNIC. Reported-by: nusenu <nusenu-lists(a)riseup.net> Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- src/python/importer.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/python/importer.py b/src/python/importer.py index 4c8406c..de340b4 100644 --- a/src/python/importer.py +++ b/src/python/importer.py @@ -47,6 +47,11 @@ WHOIS_SOURCES = { # "https://ftp.arin.net/pub/rr/arin.db" # ], + # Japan Network Information Center + "JPNIC": [ + "https://ftp.nic.ad.jp/jpirr/jpirr.db.gz" + ], + # Latin America and Caribbean Network Information Centre # XXX ??? -- 2.26.2

2 1

DB version number?
by nusenu 27 Sep '21

27 Sep '21

Hi, I use the location database for OrNetStats [1] a website that shows information about the tor network and it's operators and relays. [1] https://nusenu.github.io/OrNetStats/ For transparency and archive purposes I'd like to show the location database version that has been used for the AS number and name lookups on the website. Is there a versioning scheme of the DB? if so: How do I retrieve the version of the db file? Or is this timestamp the best bet? location update libloc: loc_discover_latest_version: Could not query _v1._db.location.ipfire.org: Downloaded new database from Sun, 26 Sep 2021 05:52:59 GMT I'm not looking for the version of the tool itself (which is shown via location --version ). kind regards, nusenu -- https://nusenu.github.io

3 6

[PATCH] override-{a3,other}: regular batch of various overrides
by Peter Müller 27 Sep '21

27 Sep '21

Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- overrides/override-a3.txt | 10 ++++++++++ overrides/override-other.txt | 20 ++++++++++++++++++++ 2 files changed, 30 insertions(+) diff --git a/overrides/override-a3.txt b/overrides/override-a3.txt index 83bfb24..6b8f886 100644 --- a/overrides/override-a3.txt +++ b/overrides/override-a3.txt @@ -1790,6 +1790,16 @@ descr: Informatics Solutions Limited remarks: Generic anycast network is-anycast: yes +net: 2001:978:1403::/48 +descr: HAProxy Technologies, Inc. +remarks: Hosted HAProxy Anycast services? +is-anycast: yes + +net: 2600:1400::/24 +descr: Akamai Technologies, Inc. +remarks: Worldwide CDN, does not make sense to assign their networks to a specific country +is-anycast: yes + net: 2606:4700:4700::/48 descr: Cloudflare, Inc. remarks: Public anycast DNS resolver diff --git a/overrides/override-other.txt b/overrides/override-other.txt index e99325b..581ca5a 100644 --- a/overrides/override-other.txt +++ b/overrides/override-other.txt @@ -459,6 +459,11 @@ descr: LLC Baxet remarks: tampers with RIR data, traces back to RU country: RU +aut-num: AS49447 +descr: Nice IT Services Group Inc. +remarks: Rogue ISP located in CH, but some RIR data for announced prefixes contain garbage +country: CH + aut-num: AS49466 descr: KLAYER LLC remarks: part of the "Asline" IP hijacking gang, traces back to AP region @@ -824,6 +829,11 @@ descr: SANREN DATA LIMITED remarks: IP hijacker located somewhere in AP region, tampers with RIR data country: AP +aut-num: AS139640 +descr: HK NEW CLOUD TECHNOLOGY LIMITED +remarks: ISP and/or IP hijacker located in AP area, tampers with RIR data +country: AP + aut-num: AS139646 descr: HONG KONG Megalayer Technology Co.,Limited remarks: ISP and/or IP hijacker located in HK, tampers with RIR data @@ -1069,6 +1079,11 @@ descr: Gudaev Maxim Amrakhovich remarks: announcements scatter across various places in EU (DE/CZ/??), but RIR data contain garbage country: EU +aut-num: AS209519 +descr: Packet Flip, LLC +remarks: ISP located in US, but some RIR data for announced prefixes contain garbage +country: US + aut-num: AS210119 descr: VPSSC Networks LTD remarks: ISP located in UA, but RIR data for announced prefixes contain garbage @@ -1349,6 +1364,11 @@ descr: IP Volume Ltd. / Epik remarks: fake location (CH), traces back to NO country: NO +net: 91.216.210.0/24 +descr: EasyForex Ltd. +remarks: fake location (CY), traces to IE area +country: IE + net: 91.243.32.0/19 descr: Petersburg Internet Network Ltd. remarks: RIR data for suballocations contain garbage, they are all located in RU -- 2.20.1

1 0

[PATCH] debian: Ensure changelog distribution is tagged
by Valters Jansons 23 Sep '21

23 Sep '21

UNRELEASED should not be left as-is when actually releasing. The latest changelog entry now point at unstable instead. The simple d/genchangelog.sh now does `dch -r ''` automatically to ensure this distribution update doesn't get lost along the way on future invocations. --- I am still not sure what to propose for organizing this better across multiple projects. In our organization we use `repo` by Google, originally intended for syncing Android repositories, so that we track multiple repositories that belong together while avoiding mono-repos. It uses a default.xml manifest file in a dedicated "manifest" repo, which then just lists which repositories should be pulled in. Command/tool ref: https://source.android.com/setup/develop/repo Manifest file ref: https://gerrit.googlesource.com/git-repo/+/master/docs/manifest-format.md A sample manifest, which should do the trick, could be: <?xml version="1.0" encoding="UTF-8"?> <manifest> <remote name="origin" fetch="https://git.ipfire.org/pub/git/" pushurl="ssh://people.ipfire.org/pub/git/" /> <default remote="origin" revision="master" /> <project name="location/libloc" /> <project name="location/location-database" /> </manifest> debian/changelog | 2 +- debian/genchangelog.sh | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/debian/changelog b/debian/changelog index fcef2cb..3b90542 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,4 +1,4 @@ -libloc (0.9.8-1) UNRELEASED; urgency=medium +libloc (0.9.8-1) unstable; urgency=medium [ Michael Tremer ] * importer: Do not try to initialise a column that cannot be NULL with diff --git a/debian/genchangelog.sh b/debian/genchangelog.sh index 85d3922..ab1c198 100755 --- a/debian/genchangelog.sh +++ b/debian/genchangelog.sh @@ -31,6 +31,8 @@ main () { echo "$author_name <$author_email> $subject" DEBFULLNAME="$author_name" DEBEMAIL="$author_email" debchange --upstream --multimaint-merge "$subject" done + + debchange --release '' } main "$@" || exit $? -- 2.33.0

2 1

[PATCH] override-{a1,other}: regular batch of various overrides
by Peter Müller 02 Sep '21

02 Sep '21

Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- overrides/override-a1.txt | 177 ++++++++++++++++++++++++++++++++++- overrides/override-other.txt | 20 ++++ 2 files changed, 195 insertions(+), 2 deletions(-) diff --git a/overrides/override-a1.txt b/overrides/override-a1.txt index b4940b2..acb5cb2 100644 --- a/overrides/override-a1.txt +++ b/overrides/override-a1.txt @@ -34,6 +34,11 @@ descr: Maginfo remarks: VPN provider is-anonymous-proxy: yes +aut-num: AS13487 +descr: ULTRA PACKET LLC +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… +is-anonymous-proxy: yes + aut-num: AS16255 descr: IRIDIUM PROVIDER LTD remarks: VPN provider [high confidence, but not proofed] located in RU @@ -99,6 +104,11 @@ descr: Layer 3 VPN ASN remarks: VPN provider is-anonymous-proxy: yes +aut-num: AS46732 +descr: RESIDENTIAL NETWORKING SOLUTIONS LLC +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… +is-anonymous-proxy: yes + aut-num: AS51432 descr: BeeVPN ApS remarks: VPN provider @@ -184,6 +194,11 @@ descr: AMPR VPN remarks: VPN provider is-anonymous-proxy: yes +aut-num: AS197640 +descr: OverPlay.Net LP +remarks: VPN and/or proxy provider +is-anonymous-proxy: yes + aut-num: AS201665 descr: Anonymizer, Inc. remarks: VPN provider @@ -206,6 +221,22 @@ remarks: VPN provider located in BR [high confidence, but not proofed] is-anonymous-proxy: yes country: BR +aut-num: AS207907 +descr: NSQ Venture (M) SDN BHD +remarks: Possibly part of https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net…, also tampers with RIR data +is-anonymous-proxy: yes +country: US + +aut-num: AS207976 +descr: V6 Networking LLC +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… +is-anonymous-proxy: yes + +aut-num: AS208256 +descr: Stingers, Inc. +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… +is-anonymous-proxy: yes + aut-num: AS208294 descr: CIA TRIAD SECURITY LLC remarks: Tor relay provider located in or near Berlin, DE @@ -229,6 +260,11 @@ remarks: (Rogue) VPN provider is-anonymous-proxy: yes country: EU +aut-num: AS208979 +descr: RESNET INC +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… +is-anonymous-proxy: yes + aut-num: AS209623 descr: David Craig remarks: (Rogue) VPN provider @@ -297,16 +333,47 @@ descr: Castle VPN remarks: VPN provider is-anonymous-proxy: yes +aut-num: AS397539 +descr: LAKSH CYBERSECURITY AND DEFENSE LLC +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… +is-anonymous-proxy: yes + aut-num: AS397685 descr: Business VPN LLC remarks: VPN provider is-anonymous-proxy: yes +aut-num: AS397770 +descr: LAKSH CYBERSECURITY AND DEFENSE LLC +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… +is-anonymous-proxy: yes + +aut-num: AS397881 +descr: Stingers, Inc. +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… +is-anonymous-proxy: yes + +aut-num: AS398083 +descr: Ting Wireless +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… +is-anonymous-proxy: yes +country: US + aut-num: AS398271 descr: HardenedVPN[.]com LLC remarks: VPN provider is-anonymous-proxy: yes +aut-num: AS398481 +descr: RedMercury Ltd. +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… +is-anonymous-proxy: yes + +aut-num: AS398559 +descr: Tunbroker LLC +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… +is-anonymous-proxy: yes + aut-num: AS399928 descr: STELLAR PROXIES remarks: VPN or open proxy provider @@ -317,6 +384,11 @@ descr: VPN Consumer Network remarks: VPN provider is-anonymous-proxy: yes +net: 2.59.248.0/22 +descr: Mayak Creative Ltd. +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… +is-anonymous-proxy: yes + net: 5.62.16.0/24 descr: Privax LTD / PRCDN Consumer Pool / AVAST s.r.o. remarks: VPN provider @@ -367,6 +439,11 @@ descr: Privax LTD / PRCDN Consumer Pool / AVAST s.r.o. remarks: VPN provider is-anonymous-proxy: yes +net: 5.181.40.0/22 +descr: Tal Mukdasi +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… +is-anonymous-proxy: yes + net: 5.182.34.0/24 descr: Coca Proxies VOF remarks: VPN provider @@ -382,6 +459,11 @@ descr: VPNTunnel remarks: VPN provider is-anonymous-proxy: yes +net: 5.253.56.0/22 +descr: Mayak Consulting Ltd. +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… +is-anonymous-proxy: yes + net: 5.254.128.0/19 descr: VPNTunnel / Hushy VPN / Anonine VPN / Edelino Commerce Inc. remarks: VPN provider @@ -497,6 +579,12 @@ descr: GZ Systems Limited / PureVPN remarks: VPN provider is-anonymous-proxy: yes +net: 45.8.92.0/22 +descr: Cloud Computing Ltd. +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… +is-anonymous-proxy: yes +country: US + net: 45.9.12.0/22 descr: VPNHost SIA remarks: VPN provider @@ -552,6 +640,16 @@ descr: Secure Internet LLC remarks: VPN provider is-anonymous-proxy: yes +net: 45.131.168.0/22 +descr: Xantho Ltd. +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… +is-anonymous-proxy: yes + +net: 45.135.160.0/22 +descr: Revonia Ltd. / LAKSH / IAPS +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… +is-anonymous-proxy: yes + net: 45.142.122.0/24 descr: Shtrauh Andrey remarks: VPN provider [high confidence, but not proofed] @@ -573,6 +671,16 @@ descr: Express VPN International Ltd remarks: VPN provider is-anonymous-proxy: yes +net: 45.155.128.0/22 +descr: Revonia Ltd. / LAKSH / IAPS +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… +is-anonymous-proxy: yes + +net: 45.157.36.0/22 +descr: Gabor Marton +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… +is-anonymous-proxy: yes + net: 45.220.72.0/22 descr: Low budget VPN service remarks: VPN provider @@ -590,7 +698,7 @@ is-anonymous-proxy: yes net: 46.36.200.0/22 descr: IAPS Security Services, L.L.C. -remarks: VPN provider +remarks: VPN provider, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… is-anonymous-proxy: yes net: 46.243.136.0/21 @@ -808,6 +916,11 @@ descr: VPNHOST SIA remarks: VPN provider is-anonymous-proxy: yes +net: 85.209.132.0/22 +descr: Mayak Creative Ltd. +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… +is-anonymous-proxy: yes + net: 88.81.248.0/24 descr: TopNet ISP VPN remarks: VPN provider @@ -868,6 +981,11 @@ descr: Octopusnet VPN remarks: VPN provider is-anonymous-proxy: yes +net: 95.214.160.0/22 +descr: B Consulting Ltd. +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… +is-anonymous-proxy: yes + net: 98.159.233.0/24 descr: VPN Consumer Network remarks: VPN provider @@ -1064,6 +1182,11 @@ descr: xTom Limited remarks: ... network operator thinks messing with countries and having an offshore company for it is funny :-/ is-anonymous-proxy: yes +net: 159.197.128.0/17 +descr: Nationwide Computer Systems, Inc. trading as IPTrading.com +remarks: Hijacked and loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… +is-anonymous-proxy: yes + net: 161.129.60.0/24 descr: 10VPN Hosting remarks: VPN provider @@ -1235,6 +1358,16 @@ descr: Freedom of Speech VPN / nVPN / David Craig remarks: (Rogue) VPN provider is-anonymous-proxy: yes +net: 185.147.100.0/22 +remarks: Mayak Smart Services Ltd. +descr: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… +is-anonymous-proxy: yes + +net: 185.147.213.0/24 +descr: Strong Technology SE +remarks: VPN provider +is-anonymous-proxy: yes + net: 185.153.177.0/24 descr: NordVPN remarks: VPN provider @@ -1313,6 +1446,11 @@ descr: VKVPN remarks: VPN provider is-anonymous-proxy: yes +net: 185.239.244.0/22 +descr: Xantho Ltd. +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… +is-anonymous-proxy: yes + net: 185.244.28.0/22 descr: Angelo Kreikamp trading as Forhosting / Freedom of Speech VPN / nVPN / David Craig / ... remarks: (Rogue) VPN provider @@ -1324,6 +1462,21 @@ remarks: (Rogue) VPN provider, fake location (SC), traces back to NL is-anonymous-proxy: yes country: NL +net: 185.244.104.0/22 +descr: Xantho Ltd. +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… +is-anonymous-proxy: yes + +net: 185.246.236.0/22 +descr: Xantho Ltd. +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… +is-anonymous-proxy: yes + +net: 185.254.16.0/22 +descr: Xantho Ltd. +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… +is-anonymous-proxy: yes + net: 186.2.160.0/20 descr: DDOS-GUARD CORP. remarks: IP chunk owned by an offshore company, abuse contact is a freemail address, address says "1/2 Miles Northern Highway, Belize" @@ -1489,6 +1642,16 @@ descr: NordVPN remarks: VPN provider is-anonymous-proxy: yes +net: 194.38.40.0/22 +descr: BIDIT Ltd. +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… +is-anonymous-proxy: yes + +net: 194.48.100.0/22 +descr: B Consulting Ltd. +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… +is-anonymous-proxy: yes + net: 194.87.207.0/24 descr: Lynx Proxies Ltd. remarks: VPN provider @@ -1521,7 +1684,7 @@ is-anonymous-proxy: yes net: 196.52.0.0/14 descr: LogicWeb Inc. / BGRVPN / Private Internet Access / VPNetworks / CookieProxy / etc. pp. -remarks: large IP chunk mostly used by VPN providers +remarks: Hijacked AfriNIC IP chunk mostly used by VPN providers is-anonymous-proxy: yes net: 196.61.192.0/20 @@ -1539,6 +1702,11 @@ descr: Defender cloud international LLC remarks: VPN provider [high confidence, but not proofed] is-anonymous-proxy: yes +net: 198.228.0.0/16 +descr: Service Provider Corporation +remarks: Hijacked and loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… +is-anonymous-proxy: yes + net: 199.249.223.0/24 descr: Quintex Alliance Consulting remarks: Tor relay provider @@ -1754,6 +1922,11 @@ descr: CACHE-VPN-NET remarks: VPN provider [high confidence, but not proofed] is-anonymous-proxy: yes +net: 2a03:b600::/29 +descr: IAPS Security Services, L.L.C. +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… +is-anonymous-proxy: yes + net: 2a03:e600:100::/48 descr: Foundation for Applied Privacy remarks: Tor relay provider diff --git a/overrides/override-other.txt b/overrides/override-other.txt index 2c7caaa..e99325b 100644 --- a/overrides/override-other.txt +++ b/overrides/override-other.txt @@ -354,6 +354,11 @@ descr: NextGenWebs, S.L. remarks: traces back to NL country: NL +aut-num: AS42237 +descr: AMATI FOUNDATION +remarks: ISP located in SE, seems to tamper with RIR data (proxies too?) +country: SE + aut-num: AS42397 descr: Bunea TELECOM SRL remarks: ISP located in RO, but some RIR data for announced prefixes contain garbage @@ -989,6 +994,11 @@ descr: AAEX NETWORK TECHNOLOGY LTD remarks: IP hijacker located in HK country: HK +aut-num: AS207429 +descr: Kapteyan Bilisim Teknolojileri +remarks: ISP located in TR, but many RIR data for announced prefixes contain garbage +country: TR + aut-num: AS207461 descr: Liquid IO remarks: ISP located in US, but many RIR data for announced prefixes contain garbage @@ -1024,6 +1034,11 @@ descr: Internet Hosting Ltd. remarks: another shady customer of "Tamatiya EOOD / 4Vendeta", located in BG, tampers with RIR data country: BG +aut-num: AS208485 +descr: Nese Mala / Moon DC +remarks: shady ISP located in TR, but many RIR data for announced prefixes contain garbage +country: TR + aut-num: AS209132 descr: Alviva Holding Limited remarks: ISP located in BG, but RIR data for announced prefixes contain garbage @@ -1044,6 +1059,11 @@ descr: SEMrush CY LTD remarks: claims CY for announced prefixes, but they are all hosted in NL country: NL +aut-num: AS209371 +descr: Cenk Aksit +remarks: shady ISP located in TR, but RIR data for announced prefixes contain garbage +country: TR + aut-num: AS209401 descr: Gudaev Maxim Amrakhovich remarks: announcements scatter across various places in EU (DE/CZ/??), but RIR data contain garbage -- 2.20.1

1 0

2024

2023

2022

2021

2020

2019

2018

2017

Location September 2021