Location January 2022

location@lists.ipfire.org

4 participants
6 discussions

location db mismatch
by nusenu 08 Feb '22

08 Feb '22

Hi, I'm trying to understand a difference between the local updated database and the output seen on location.ipfire.org: sha256sum /var/lib/location/database.db fe305bea50c2a916cf9f5c4a1bdee8457ced3033279d7e64598141bb0f1bd607 /var/lib/location/database.db location version Fri, 21 Jan 2022 05:50:50 GMT location:amd64 0.9.9-2 location lookup 89.58.16.0 89.58.16.0: Network : 89.58.16.0/22 Country : Germany Autonomous System : AS197540 - netcup GmbH https://location.ipfire.org/lookup/89.58.16.0 > Network 89.58.16.0/22 > Announced by AS197540 - netcup GmbH > Country Austria https://stat.ripe.net/widget/whois#w.resource=89.58.16.0 > inetnum 89.58.16.0/22 > netname AT-NETCUP-01 > country AT > status ASSIGNED PA > mnt-by NETCUP-MNT > mnt-by NETCUP-MNT > source RIPE I'm wondering if something is broken on my side? kind regards, nusenu -- https://nusenu.github.io

5 11

ASNs without AS name information (LACNIC and JPNIC)
by nusenu 19 Jan '22

19 Jan '22

Hi, I'm currently evaluating whether I should use ipfire or RIPEstat for AS information. (low number of lookups, lookup latency is not an issue) For tor relay IPs I found 54 ASNs where ipfire's DB has no AS name information. These are likely related to LACNIC and JPNIC. Are there plans to add AS names for these regions as well or will this not improve in the near future (before 2022)? kind regards, nusenu +-----------+---------+ | as_number | country | +-----------+---------+ | AS61493 | ar | | AS7303 | ar | | AS18881 | br | | AS19182 | br | | AS262287 | br | | AS264381 | br | | AS267436 | br | | AS268207 | br | | AS269070 | br | | AS27699 | br | | AS27715 | br | | AS28126 | br | | AS28271 | br | | AS28573 | br | | AS28668 | br | | AS53024 | br | | AS53111 | br | | AS53187 | br | | AS7162 | br | | AS7738 | br | | AS8167 | br | | AS22047 | cl | | AS265831 | cl | | AS270013 | cl | | AS27651 | cl | | AS52368 | cl | | AS64111 | cl | | AS7418 | cl | | AS13489 | co | | AS11830 | cr | | AS3790 | cr | | AS52423 | cr | | AS28118 | do | | AS10010 | jp | | AS17676 | jp | | AS18126 | jp | | AS2510 | jp | | AS2514 | jp | | AS2516 | jp | | AS2527 | jp | | AS4685 | jp | | AS4694 | jp | | AS4713 | jp | | AS4725 | jp | | AS59103 | jp | | AS7506 | jp | | AS7684 | jp | | AS9370 | jp | | AS9371 | jp | | AS13999 | mx | | AS278 | mx | | AS6503 | mx | | AS8151 | mx | | AS27956 | pa | +-----------+---------+

3 11

[PATCH v2] override-{a1, other, xd}: Regular batch of various overrides
by Peter Müller 16 Jan '22

16 Jan '22

The second version of this patch keeps a necessary override for AS207812, which was mistakenly deleted completely in the first version. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- overrides/override-a1.txt | 5 ++ overrides/override-other.txt | 97 +++++++++++++++++++----------------- overrides/override-xd.txt | 66 +++++++++++++++++++++--- 3 files changed, 116 insertions(+), 52 deletions(-) diff --git a/overrides/override-a1.txt b/overrides/override-a1.txt index 43e0174..a97e7ce 100644 --- a/overrides/override-a1.txt +++ b/overrides/override-a1.txt @@ -639,6 +639,11 @@ descr: Gabor Marton remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… is-anonymous-proxy: yes +net: 45.203.128.0/18 +descr: ProxyWow LLC +remarks: CloudInnovation space leased to "ProxyWow LLC" - not a safe area to accept traffic from anyways +is-anonymous-proxy: yes + net: 45.220.72.0/22 descr: Low budget VPN service remarks: VPN provider diff --git a/overrides/override-other.txt b/overrides/override-other.txt index 89ad8e0..a8faabf 100644 --- a/overrides/override-other.txt +++ b/overrides/override-other.txt @@ -63,6 +63,11 @@ aut-num: AS4134 name: Chinanet Backbone remarks: has no sane AS name set in APNIC DB +aut-num: AS4609 +descr: Companhia de Telecomunicacones de Macau SARL +remarks: ISP located in MO, but some RIR data needs manual correction due to ARIN DB situation +country: MO + aut-num: AS4754 name: Software Technology Park of India remarks: has no sane AS name set in APNIC DB @@ -90,6 +95,11 @@ descr: Greek Research and Technology Network (GRNET) S.A. remarks: ... located in GR country: GR +aut-num: AS6079 +descr: RCN +remarks: ISP located in US, but some RIR data for announced prefixes contain garbage +country: US + aut-num: AS6134 descr: XNNET LLC remarks: traces back to HK, seems to tamper with RIR data @@ -208,6 +218,11 @@ descr: Unicycle, LLC remarks: traces back to NL country: NL +aut-num: AS26548 +descr: PureVoltage Hosting Inc. +remarks: ISP and IP hijacker located in US, but some RIR data for announced prefixes contain garbage +country: US + aut-num: AS26636 descr: GBTCloud, Inc. remarks: ISP located in US, but some RIR data for announced prefixes contain garbage @@ -263,6 +278,11 @@ descr: Neterra Ltd. remarks: ISP located in BG, but some RIR data for announced prefixes contain garbage country: BG +aut-num: AS34549 +descr: meerfarbig GmbH & Co. KG +remarks: ISP located in DE, but some RIR data for announced prefixes contain garbage +country: DE + aut-num: AS34665 descr: Petersburg Internet Network Ltd. remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage @@ -388,10 +408,10 @@ descr: MLAB Open Source Community remarks: traces back to DE country: DE -aut-num: AS41564 -descr: Orion Network Limited -remarks: shady uplink for a bunch of dirty ISPs in SE (and likely elsewhere in EU), routing stolen AfriNIC networks, RIR data of prefixes announced by this AS cannot be trusted -country: SE +aut-num: AS41378 +descr: Kirino LLC +remarks: traces back to AP vincinity, tampers with RIR data +country: AP aut-num: AS41608 descr: NextGenWebs, S.L. @@ -603,11 +623,6 @@ descr: Reliance Jio Infocomm Limited remarks: ISP located in IN, but some RIR data for announced prefixes contain garbage country: IN -aut-num: AS55933 -descr: Cloudie Limited -remarks: part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to AP region -country: AP - aut-num: AS56322 descr: ServerAstra Kft. remarks: ISP located in HU, but some RIR data for announced prefixes contain garbage @@ -633,16 +648,6 @@ descr: Telefonica LLC remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage country: RU -aut-num: AS57858 -descr: Inter Connects Inc. -remarks: part of a dirty ISP conglomerate operating most likely out of SE, hijacking stolen AfriNIC networks, massively tampers with RIR data -country: SE - -aut-num: AS57972 -descr: Inter Connects Inc. -remarks: part of a dirty ISP conglomerate operating most likely out of SE, hijacking stolen AfriNIC networks, massively tampers with RIR data -country: SE - aut-num: AS58061 descr: Scalaxy B.V. remarks: ISP located in NL, but some RIR data for announced prefixes contain garbage @@ -665,8 +670,8 @@ country: BG aut-num: AS58349 descr: INNETRA PC -remarks: another shady customer of "DDoS Guard Ltd.", jurisdiction is probably RU, but traceroutes dead-end somewhere else in EU -country: EU +remarks: ... traceroutes dead-end in NL +country: NL aut-num: AS58879 descr: Shanghai Anchang Network Security Technology Co.,Ltd. @@ -723,11 +728,6 @@ descr: DignusData LLC remarks: ISP located in PL, but _all_ RIR data for announced prefixes contain garbage country: PL -aut-num: AS60485 -descr: Inter Connects Inc. / Jing Yun -remarks: part of a dirty ISP conglomerate operating most likely out of SE, hijacking AfriNIC networks -country: SE - aut-num: AS60546 descr: EU Routing Ltd remarks: fake offshore location (CY), hosted in NL @@ -818,6 +818,11 @@ descr: CloudITIDC Global remarks: ISP and/or IP hijacker located somewhere in AP country: AP +aut-num: AS133613 +descr: MTel telecommunication company ltd. +remarks: ISP and located in MO, but some prefixes needs manual correction due to ARIN DB situation +country: MO + aut-num: AS133752 descr: Leaseweb Asia Pacific pte. ltd. remarks: ISP located in HK, some RIR data for announced prefixes contain garbage @@ -853,6 +858,11 @@ descr: LUOGELANG (FRANCE) LIMITED remarks: Shady ISP located in HK, RIR data for announced prefixes contain garbage country: HK +aut-num: AS136167 +descr: China Telecom (Macau) Company Limited +remarks: located in MO, yet some prefixes show CN or HK instead +country: MO + aut-num: AS136274 descr: Cloud Servers Pvt Ltd remarks: ISP located in NL, all RIR data for announced prefixes contain garbage @@ -918,11 +928,6 @@ descr: Cloudflare Sydney, LLC remarks: ... but CF failed to set the country for announced prefixes to AU as well :-/ country: AU -aut-num: AS139330 -descr: SANREN DATA LIMITED -remarks: IP hijacker located somewhere in AP region, tampers with RIR data -country: AP - aut-num: AS139471 descr: HWA CENT TELECOMMUNICATIONS LIMITED remarks: ISP and/or IP hijacker located in AP area, tampers with RIR data @@ -955,7 +960,7 @@ country: HK aut-num: AS139879 descr: Galaxy Broadband -remarks: ISP located in PK, but announces 204.137.128.0/18, which is ARIN space, assigned to "AGIS" / Cogent - odd... +remarks: ISP located in PK, but some RIR data need manual correction due to ARIN DB situation country: PK aut-num: AS140214 @@ -983,10 +988,10 @@ descr: Full Time Hosting remarks: ISP located in DE, tampers with RIR data country: DE -aut-num: AS141746 -descr: Orenji Server -remarks: IP hijacker located somewhere in AP area (JP?) -country: AP +aut-num: AS141677 +descr: Nathosts Limited +remarks: ... located in HK? +country: HK aut-num: AS196682 descr: FLP Kochenov Aleksej Vladislavovich @@ -1138,6 +1143,11 @@ descr: Inteldome Corporation remarks: ... whose location we are unable to determine precisely, but its definitely not MH :-/ country: EU +aut-num: AS207812 +descr: DM AUTO EOOD +remarks: another shady customer of "Tamatiya EOOD / 4Vendeta", located in BG, tampers with RIR data +country: BG + aut-num: AS207968 descr: Internetservice Hahn remarks: AQ != DE, you know @@ -1198,11 +1208,6 @@ descr: Des Capital B.V. remarks: Shady ISP located in NL, but RIR data for announced prefixes contain garbage country: NL -aut-num: AS210848 -descr: Telkom Internet LTD -remarks: shady ISP currently located in NL -country: NL - aut-num: AS211380 descr: PAYWISE HOLDING Sp. z.o.o. remarks: ISP located in NL, but RIR data for announced prefixes contain garbage @@ -1248,11 +1253,6 @@ descr: MILEGROUP LTD remarks: traceroutes dead-end somewhere in Central Europe country: EU -aut-num: AS212552 -descr: BitCommand LLC -remarks: Hides behind a CDN ISP, traceroutes dead-end somewhere in Central Europe -country: EU - aut-num: AS212667 descr: RECONN LLC remarks: ISP located in RU, but RIR data for announced prefixes contain garbage @@ -1533,6 +1533,11 @@ descr: SpaceX Canada Corp. remarks: Accurate country code missing due to ARIN DB situation, see also: #12746 country: CA +net: 103.126.4.0/23 +descr: Cyber Telecom ISP +remarks: Despite being allocated to AF, traceroutes end in NL +country: NL + net: 103.197.148.0/22 descr: I.C.S. Trabia-Network S.R.L. remarks: fake offshore location (HK), traces back to MD diff --git a/overrides/override-xd.txt b/overrides/override-xd.txt index 738a699..2b50406 100644 --- a/overrides/override-xd.txt +++ b/overrides/override-xd.txt @@ -67,6 +67,12 @@ descr: 1337TEAM LIMITED / eliteteam[.]to remarks: Owned by an offshore letterbox company, suspected rogue ISP drop: yes +aut-num: AS41564 +descr: Orion Network Limited +remarks: shady uplink for a bunch of dirty ISPs in SE (and likely elsewhere in EU), routing stolen AfriNIC networks, RIR data of prefixes announced by this AS cannot be trusted +country: EU +drop: yes + aut-num: AS43092 descr: Kirin Communication Limited remarks: Hijacks IP space and tampers with RIR data, traces back to JP @@ -79,6 +85,12 @@ remarks: bulletproof ISP with strong links to RU country: RU drop: yes +aut-num: AS44446 +descr: OOO SibirInvest +remarks: bulletproof ISP (related to AS202425 and AS57717) located in NL +country: NL +drop: yes + aut-num: AS48090 descr: PPTECHNOLOGY LIMITED remarks: bulletproof ISP (related to AS204655) located in NL @@ -109,6 +121,12 @@ remarks: Autonomous System registered to offshore company, abuse contact is a fr country: AP drop: yes +aut-num: AS55933 +descr: Cloudie Limited +remarks: part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to AP region +country: AP +drop: yes + aut-num: AS56611 descr: REBA Communications BV remarks: bulletproof ISP (related to AS202425) located in NL @@ -126,6 +144,18 @@ remarks: bulletproof ISP (related to AS202425) located in NL country: NL drop: yes +aut-num: AS57858 +descr: Inter Connects Inc. +remarks: part of a dirty ISP conglomerate operating most likely out of SE, hijacking stolen AfriNIC networks, massively tampers with RIR data +country: SE +drop: yes + +aut-num: AS57972 +descr: Inter Connects Inc. +remarks: part of a dirty ISP conglomerate operating most likely out of SE, hijacking stolen AfriNIC networks, massively tampers with RIR data +country: SE +drop: yes + aut-num: AS58271 descr: FOP Gubina Lubov Petrivna remarks: bulletproof ISP operating from a war zone in eastern UA @@ -143,6 +173,12 @@ descr: 1337TEAM LIMITED / eliteteam[.]to remarks: Owned by an offshore letterbox company, suspected rogue ISP drop: yes +aut-num: AS60485 +descr: Inter Connects Inc. / Jing Yun +remarks: part of a dirty ISP conglomerate operating most likely out of SE, hijacking AfriNIC networks +country: SE +drop: yes + aut-num: AS61414 descr: EDGENAP LTD remarks: IP hijacking? Rogue ISP? @@ -190,6 +226,12 @@ remarks: IP hijacker located somewhere in AP area country: AP drop: yes +aut-num: AS139330 +descr: SANREN DATA LIMITED +remarks: IP hijacker located somewhere in AP region, tampers with RIR data +country: AP +drop: yes + aut-num: AS140107 descr: CITIS CLOUD GROUP LIMITED remarks: part of the "Asline" IP hijacking gang, tampers with RIR data, location unknown (AP? HK? US?) @@ -201,6 +243,12 @@ remarks: ISP and IP hijacker located in HK, tampers with RIR data country: HK drop: yes +aut-num: AS141746 +descr: Orenji Server +remarks: IP hijacker located somewhere in AP area (JP?) +country: AP +drop: yes + aut-num: AS200391 descr: KREZ 999 EOOD remarks: another shady customer of "Tamatiya EOOD / 4Vendeta", located in BG, tampers with RIR data @@ -231,24 +279,30 @@ remarks: bulletproof ISP (strongly linked to AS202425) located in NL country: NL drop: yes -aut-num: AS207812 -descr: DM AUTO EOOD -remarks: another shady customer of "Tamatiya EOOD / 4Vendeta", located in BG, tampers with RIR data -country: BG -drop: yes - aut-num: AS209272 descr: Alviva Holding Limited remarks: bulletproof ISP operating from a war zone in eastern UA country: UA drop: yes +aut-num: AS210848 +descr: Telkom Internet LTD +remarks: Rogue ISP (linked to AS202425) located in NL +country: NL +drop: yes + aut-num: AS211193 descr: ABDILAZIZ UULU ZHUSUP remarks: bulletproof ISP and IP hijacker, traces to RU country: RU drop: yes +aut-num: AS212552 +descr: BitCommand LLC +remarks: Dirty ISP located somewhere in EU, cannot trust RIR data of this network +country: EU +drop: yes + aut-num: AS213058 descr: Private Internet Hosting LTD remarks: bulletproof ISP located in RU -- 2.31.1

1 0

[PATCH] override-{a1,other,xd}: Regular batch of various overrides
by Peter Müller 16 Jan '22

16 Jan '22

Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- overrides/override-a1.txt | 5 ++ overrides/override-other.txt | 92 ++++++++++++++++++------------------ overrides/override-xd.txt | 66 +++++++++++++++++++++++--- 3 files changed, 111 insertions(+), 52 deletions(-) diff --git a/overrides/override-a1.txt b/overrides/override-a1.txt index 43e0174..a97e7ce 100644 --- a/overrides/override-a1.txt +++ b/overrides/override-a1.txt @@ -639,6 +639,11 @@ descr: Gabor Marton remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… is-anonymous-proxy: yes +net: 45.203.128.0/18 +descr: ProxyWow LLC +remarks: CloudInnovation space leased to "ProxyWow LLC" - not a safe area to accept traffic from anyways +is-anonymous-proxy: yes + net: 45.220.72.0/22 descr: Low budget VPN service remarks: VPN provider diff --git a/overrides/override-other.txt b/overrides/override-other.txt index 89ad8e0..c33e642 100644 --- a/overrides/override-other.txt +++ b/overrides/override-other.txt @@ -63,6 +63,11 @@ aut-num: AS4134 name: Chinanet Backbone remarks: has no sane AS name set in APNIC DB +aut-num: AS4609 +descr: Companhia de Telecomunicacones de Macau SARL +remarks: ISP located in MO, but some RIR data needs manual correction due to ARIN DB situation +country: MO + aut-num: AS4754 name: Software Technology Park of India remarks: has no sane AS name set in APNIC DB @@ -90,6 +95,11 @@ descr: Greek Research and Technology Network (GRNET) S.A. remarks: ... located in GR country: GR +aut-num: AS6079 +descr: RCN +remarks: ISP located in US, but some RIR data for announced prefixes contain garbage +country: US + aut-num: AS6134 descr: XNNET LLC remarks: traces back to HK, seems to tamper with RIR data @@ -208,6 +218,11 @@ descr: Unicycle, LLC remarks: traces back to NL country: NL +aut-num: AS26548 +descr: PureVoltage Hosting Inc. +remarks: ISP and IP hijacker located in US, but some RIR data for announced prefixes contain garbage +country: US + aut-num: AS26636 descr: GBTCloud, Inc. remarks: ISP located in US, but some RIR data for announced prefixes contain garbage @@ -263,6 +278,11 @@ descr: Neterra Ltd. remarks: ISP located in BG, but some RIR data for announced prefixes contain garbage country: BG +aut-num: AS34549 +descr: meerfarbig GmbH & Co. KG +remarks: ISP located in DE, but some RIR data for announced prefixes contain garbage +country: DE + aut-num: AS34665 descr: Petersburg Internet Network Ltd. remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage @@ -388,10 +408,10 @@ descr: MLAB Open Source Community remarks: traces back to DE country: DE -aut-num: AS41564 -descr: Orion Network Limited -remarks: shady uplink for a bunch of dirty ISPs in SE (and likely elsewhere in EU), routing stolen AfriNIC networks, RIR data of prefixes announced by this AS cannot be trusted -country: SE +aut-num: AS41378 +descr: Kirino LLC +remarks: traces back to AP vincinity, tampers with RIR data +country: AP aut-num: AS41608 descr: NextGenWebs, S.L. @@ -603,11 +623,6 @@ descr: Reliance Jio Infocomm Limited remarks: ISP located in IN, but some RIR data for announced prefixes contain garbage country: IN -aut-num: AS55933 -descr: Cloudie Limited -remarks: part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to AP region -country: AP - aut-num: AS56322 descr: ServerAstra Kft. remarks: ISP located in HU, but some RIR data for announced prefixes contain garbage @@ -633,16 +648,6 @@ descr: Telefonica LLC remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage country: RU -aut-num: AS57858 -descr: Inter Connects Inc. -remarks: part of a dirty ISP conglomerate operating most likely out of SE, hijacking stolen AfriNIC networks, massively tampers with RIR data -country: SE - -aut-num: AS57972 -descr: Inter Connects Inc. -remarks: part of a dirty ISP conglomerate operating most likely out of SE, hijacking stolen AfriNIC networks, massively tampers with RIR data -country: SE - aut-num: AS58061 descr: Scalaxy B.V. remarks: ISP located in NL, but some RIR data for announced prefixes contain garbage @@ -665,8 +670,8 @@ country: BG aut-num: AS58349 descr: INNETRA PC -remarks: another shady customer of "DDoS Guard Ltd.", jurisdiction is probably RU, but traceroutes dead-end somewhere else in EU -country: EU +remarks: ... traceroutes dead-end in NL +country: NL aut-num: AS58879 descr: Shanghai Anchang Network Security Technology Co.,Ltd. @@ -723,11 +728,6 @@ descr: DignusData LLC remarks: ISP located in PL, but _all_ RIR data for announced prefixes contain garbage country: PL -aut-num: AS60485 -descr: Inter Connects Inc. / Jing Yun -remarks: part of a dirty ISP conglomerate operating most likely out of SE, hijacking AfriNIC networks -country: SE - aut-num: AS60546 descr: EU Routing Ltd remarks: fake offshore location (CY), hosted in NL @@ -818,6 +818,11 @@ descr: CloudITIDC Global remarks: ISP and/or IP hijacker located somewhere in AP country: AP +aut-num: AS133613 +descr: MTel telecommunication company ltd. +remarks: ISP and located in MO, but some prefixes needs manual correction due to ARIN DB situation +country: MO + aut-num: AS133752 descr: Leaseweb Asia Pacific pte. ltd. remarks: ISP located in HK, some RIR data for announced prefixes contain garbage @@ -853,6 +858,11 @@ descr: LUOGELANG (FRANCE) LIMITED remarks: Shady ISP located in HK, RIR data for announced prefixes contain garbage country: HK +aut-num: AS136167 +descr: China Telecom (Macau) Company Limited +remarks: located in MO, yet some prefixes show CN or HK instead +country: MO + aut-num: AS136274 descr: Cloud Servers Pvt Ltd remarks: ISP located in NL, all RIR data for announced prefixes contain garbage @@ -918,11 +928,6 @@ descr: Cloudflare Sydney, LLC remarks: ... but CF failed to set the country for announced prefixes to AU as well :-/ country: AU -aut-num: AS139330 -descr: SANREN DATA LIMITED -remarks: IP hijacker located somewhere in AP region, tampers with RIR data -country: AP - aut-num: AS139471 descr: HWA CENT TELECOMMUNICATIONS LIMITED remarks: ISP and/or IP hijacker located in AP area, tampers with RIR data @@ -955,7 +960,7 @@ country: HK aut-num: AS139879 descr: Galaxy Broadband -remarks: ISP located in PK, but announces 204.137.128.0/18, which is ARIN space, assigned to "AGIS" / Cogent - odd... +remarks: ISP located in PK, but some RIR data need manual correction due to ARIN DB situation country: PK aut-num: AS140214 @@ -983,10 +988,10 @@ descr: Full Time Hosting remarks: ISP located in DE, tampers with RIR data country: DE -aut-num: AS141746 -descr: Orenji Server -remarks: IP hijacker located somewhere in AP area (JP?) -country: AP +aut-num: AS141677 +descr: Nathosts Limited +remarks: ... located in HK? +country: HK aut-num: AS196682 descr: FLP Kochenov Aleksej Vladislavovich @@ -1198,11 +1203,6 @@ descr: Des Capital B.V. remarks: Shady ISP located in NL, but RIR data for announced prefixes contain garbage country: NL -aut-num: AS210848 -descr: Telkom Internet LTD -remarks: shady ISP currently located in NL -country: NL - aut-num: AS211380 descr: PAYWISE HOLDING Sp. z.o.o. remarks: ISP located in NL, but RIR data for announced prefixes contain garbage @@ -1248,11 +1248,6 @@ descr: MILEGROUP LTD remarks: traceroutes dead-end somewhere in Central Europe country: EU -aut-num: AS212552 -descr: BitCommand LLC -remarks: Hides behind a CDN ISP, traceroutes dead-end somewhere in Central Europe -country: EU - aut-num: AS212667 descr: RECONN LLC remarks: ISP located in RU, but RIR data for announced prefixes contain garbage @@ -1533,6 +1528,11 @@ descr: SpaceX Canada Corp. remarks: Accurate country code missing due to ARIN DB situation, see also: #12746 country: CA +net: 103.126.4.0/23 +descr: Cyber Telecom ISP +remarks: Despite being allocated to AF, traceroutes end in NL +country: NL + net: 103.197.148.0/22 descr: I.C.S. Trabia-Network S.R.L. remarks: fake offshore location (HK), traces back to MD diff --git a/overrides/override-xd.txt b/overrides/override-xd.txt index 738a699..2b50406 100644 --- a/overrides/override-xd.txt +++ b/overrides/override-xd.txt @@ -67,6 +67,12 @@ descr: 1337TEAM LIMITED / eliteteam[.]to remarks: Owned by an offshore letterbox company, suspected rogue ISP drop: yes +aut-num: AS41564 +descr: Orion Network Limited +remarks: shady uplink for a bunch of dirty ISPs in SE (and likely elsewhere in EU), routing stolen AfriNIC networks, RIR data of prefixes announced by this AS cannot be trusted +country: EU +drop: yes + aut-num: AS43092 descr: Kirin Communication Limited remarks: Hijacks IP space and tampers with RIR data, traces back to JP @@ -79,6 +85,12 @@ remarks: bulletproof ISP with strong links to RU country: RU drop: yes +aut-num: AS44446 +descr: OOO SibirInvest +remarks: bulletproof ISP (related to AS202425 and AS57717) located in NL +country: NL +drop: yes + aut-num: AS48090 descr: PPTECHNOLOGY LIMITED remarks: bulletproof ISP (related to AS204655) located in NL @@ -109,6 +121,12 @@ remarks: Autonomous System registered to offshore company, abuse contact is a fr country: AP drop: yes +aut-num: AS55933 +descr: Cloudie Limited +remarks: part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to AP region +country: AP +drop: yes + aut-num: AS56611 descr: REBA Communications BV remarks: bulletproof ISP (related to AS202425) located in NL @@ -126,6 +144,18 @@ remarks: bulletproof ISP (related to AS202425) located in NL country: NL drop: yes +aut-num: AS57858 +descr: Inter Connects Inc. +remarks: part of a dirty ISP conglomerate operating most likely out of SE, hijacking stolen AfriNIC networks, massively tampers with RIR data +country: SE +drop: yes + +aut-num: AS57972 +descr: Inter Connects Inc. +remarks: part of a dirty ISP conglomerate operating most likely out of SE, hijacking stolen AfriNIC networks, massively tampers with RIR data +country: SE +drop: yes + aut-num: AS58271 descr: FOP Gubina Lubov Petrivna remarks: bulletproof ISP operating from a war zone in eastern UA @@ -143,6 +173,12 @@ descr: 1337TEAM LIMITED / eliteteam[.]to remarks: Owned by an offshore letterbox company, suspected rogue ISP drop: yes +aut-num: AS60485 +descr: Inter Connects Inc. / Jing Yun +remarks: part of a dirty ISP conglomerate operating most likely out of SE, hijacking AfriNIC networks +country: SE +drop: yes + aut-num: AS61414 descr: EDGENAP LTD remarks: IP hijacking? Rogue ISP? @@ -190,6 +226,12 @@ remarks: IP hijacker located somewhere in AP area country: AP drop: yes +aut-num: AS139330 +descr: SANREN DATA LIMITED +remarks: IP hijacker located somewhere in AP region, tampers with RIR data +country: AP +drop: yes + aut-num: AS140107 descr: CITIS CLOUD GROUP LIMITED remarks: part of the "Asline" IP hijacking gang, tampers with RIR data, location unknown (AP? HK? US?) @@ -201,6 +243,12 @@ remarks: ISP and IP hijacker located in HK, tampers with RIR data country: HK drop: yes +aut-num: AS141746 +descr: Orenji Server +remarks: IP hijacker located somewhere in AP area (JP?) +country: AP +drop: yes + aut-num: AS200391 descr: KREZ 999 EOOD remarks: another shady customer of "Tamatiya EOOD / 4Vendeta", located in BG, tampers with RIR data @@ -231,24 +279,30 @@ remarks: bulletproof ISP (strongly linked to AS202425) located in NL country: NL drop: yes -aut-num: AS207812 -descr: DM AUTO EOOD -remarks: another shady customer of "Tamatiya EOOD / 4Vendeta", located in BG, tampers with RIR data -country: BG -drop: yes - aut-num: AS209272 descr: Alviva Holding Limited remarks: bulletproof ISP operating from a war zone in eastern UA country: UA drop: yes +aut-num: AS210848 +descr: Telkom Internet LTD +remarks: Rogue ISP (linked to AS202425) located in NL +country: NL +drop: yes + aut-num: AS211193 descr: ABDILAZIZ UULU ZHUSUP remarks: bulletproof ISP and IP hijacker, traces to RU country: RU drop: yes +aut-num: AS212552 +descr: BitCommand LLC +remarks: Dirty ISP located somewhere in EU, cannot trust RIR data of this network +country: EU +drop: yes + aut-num: AS213058 descr: Private Internet Hosting LTD remarks: bulletproof ISP located in RU -- 2.31.1

1 0

[PATCH] override-{a1,other,xd}: Regular batch of various overrides
by Peter Müller 09 Jan '22

09 Jan '22

Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- overrides/override-a1.txt | 37 +------------- overrides/override-other.txt | 95 ++++++++++++++++++++++++++++-------- overrides/override-xd.txt | 34 ++++++++++++- 3 files changed, 108 insertions(+), 58 deletions(-) diff --git a/overrides/override-a1.txt b/overrides/override-a1.txt index 5b620fe..43e0174 100644 --- a/overrides/override-a1.txt +++ b/overrides/override-a1.txt @@ -729,21 +729,6 @@ descr: GZ Systems Limited / PureVPN remarks: VPN provider is-anonymous-proxy: yes -net: 62.73.7.0/24 -descr: Privax LTD / AVAST s.r.o. -remarks: VPN provider -is-anonymous-proxy: yes - -net: 62.73.8.0/23 -descr: Privax LTD / AVAST s.r.o. -remarks: VPN provider -is-anonymous-proxy: yes - -net: 62.73.10.0/24 -descr: Privax LTD / AVAST s.r.o. -remarks: VPN provider -is-anonymous-proxy: yes - net: 62.149.160.0/20 descr: Aruba VPN remarks: VPN provider @@ -835,7 +820,7 @@ is-anonymous-proxy: yes net: 80.254.74.0/20 descr: Monzoon / SwissVPN -remarks: VPN provider [high confidence, but not proofed] +remarks: VPN provider is-anonymous-proxy: yes net: 82.199.130.0/24 @@ -1135,11 +1120,6 @@ remarks: VPN provider [high confidence, but not proofed] is-anonymous-proxy: yes country: FR -net: 156.0.200.0/22 -descr: xTom Limited -remarks: ... network operator thinks messing with countries and having an offshore company for it is funny :-/ -is-anonymous-proxy: yes - net: 159.197.128.0/17 descr: Nationwide Computer Systems, Inc. trading as IPTrading.com remarks: Hijacked and loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… @@ -1236,16 +1216,6 @@ descr: Private Internet Access remarks: VPN provider is-anonymous-proxy: yes -net: 173.239.252.0/24 -descr: OculusProxies -remarks: VPN provider [high confidence, but not proofed] -is-anonymous-proxy: yes - -net: 173.239.252.0/24 -descr: BGRVPN -remarks: VPN provider -is-anonymous-proxy: yes - net: 173.244.32.0/19 descr: LogicWeb Inc. / BGRVPN / Private Internet Access / VPNetworks / CookieProxy / etc. pp. remarks: large IP chunk mostly used by VPN providers @@ -1505,11 +1475,6 @@ descr: GZ Systems Limited / PureVPN remarks: VPN provider is-anonymous-proxy: yes -net: 190.115.16.0/20 -descr: DDOS-GUARD CORP. -remarks: IP chunk owned by an offshore company, abuse contact is a freemail address, address says "1/2 Miles Northern Highway, Belize" -is-anonymous-proxy: yes - net: 191.96.1.0/23 descr: GZ Systems Limited / PureVPN remarks: VPN provider diff --git a/overrides/override-other.txt b/overrides/override-other.txt index 56bb12e..89ad8e0 100644 --- a/overrides/override-other.txt +++ b/overrides/override-other.txt @@ -92,8 +92,8 @@ country: GR aut-num: AS6134 descr: XNNET LLC -remarks: traces back to an unknown oversea location (HK?), seems to tamper with RIR data -country: AP +remarks: traces back to HK, seems to tamper with RIR data +country: HK aut-num: AS6412 name: Zajil International Telecom Company @@ -144,6 +144,11 @@ descr: Nexril remarks: ISP located in US, but some RIR data for announced prefixes contain garbage country: US +aut-num: AS15611 +descr: Iranian Research Organization for Science & Technology +remarks: ISP located in IR, but some RIR data for announced prefixes contain garbage +country: IR + aut-num: AS15828 descr: Blue Diamond Network Co., Ltd. remarks: Shady ISP located somewhere in AP @@ -268,6 +273,11 @@ descr: ASLINE LIMITED remarks: ... located in HK country: HK +aut-num: AS34837 +descr: Institute for Research in Fundamental Sciences +remarks: ISP located in IR, but some RIR data for announced prefixes contain garbage +country: IR + aut-num: AS34985 descr: Kirin Communication Limited remarks: ISP located in JP, but some RIR data for announced prefixes contain garbage @@ -468,6 +478,11 @@ descr: KeonWoo PARK remarks: claims US for its prefixes announced, but traces back to KR country: KR +aut-num: AS45250 +descr: Vocom International Telecommunications AP Area +remarks: ISP located in AP area, some RIR data for announced prefixes contain garbage +country: AP + aut-num: AS45671 descr: Servers Australia Pty. Ltd. remarks: ISP located in AU, but some RIR data for announced prefixes contain garbage @@ -578,11 +593,6 @@ descr: WhiteHat Inc. remarks: tampers with RIR data country: EU -aut-num: AS54600 -descr: PEG TECH INC -remarks: ISP and/or IP hijacker located in US this time, tampers with RIR data -country: US - aut-num: AS55330 descr: AFGHANTELECOM GOVERNMENT COMMUNICATION NETWORK remarks: For some reason, some "Airbus Defence and Space AS" prefixes are announced by this one... @@ -658,6 +668,21 @@ descr: INNETRA PC remarks: another shady customer of "DDoS Guard Ltd.", jurisdiction is probably RU, but traceroutes dead-end somewhere else in EU country: EU +aut-num: AS58879 +descr: Shanghai Anchang Network Security Technology Co.,Ltd. +remarks: ... network infrastructure is believed to be located in HK, has some links to ASLINE hijacking gang +country: HK + +aut-num: AS59043 +descr: Guangzhou LanDong Information technology co., LTD +remarks: ... network infrastructure is believed to be located in HK +country: HK + +aut-num: AS59117 +descr: DREAM CLOUD INNOVATION PTE. LTD. +remarks: Claims to be located in JP or SG, but is likely located in HK +country: HK + aut-num: AS59253 descr: Leaseweb Asia Pacific pte. ltd. remarks: ISP located in SG, but some RIR data for announced prefixes contain garbage @@ -773,6 +798,11 @@ descr: XIANGAO INTERNATIONAL TELECOMMUNICATION LIMITED remarks: ISP located in HK, tampers with RIR data country: HK +aut-num: AS132813 +descr: HK AISI CLOUD COMPUTING LIMITED +remarks: ISP and/or IP hijacker located in HK, tampers with RIR data +country: HK + aut-num: AS132839 descr: POWER LINE DATACENTER remarks: ISP and/or IP hijacker located in HK, tampers with RIR data @@ -799,7 +829,7 @@ remarks: IP hijacker located somewhere in AP area, suspected to be part of the " country: AP aut-num: AS134196 -descr: Cloudie Limited +descr: ANYUN INTERNET TECHNOLOGY (HK) CO.,LIMITED remarks: part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to AP region (HK? CN?) country: AP @@ -818,6 +848,11 @@ descr: Sky Digital Co., Ltd. remarks: IP hijacker located in TW, suspected to be part of the "Asline" IP hijacking gang, tampers with RIR data country: TW +aut-num: AS135097 +descr: LUOGELANG (FRANCE) LIMITED +remarks: Shady ISP located in HK, RIR data for announced prefixes contain garbage +country: HK + aut-num: AS136274 descr: Cloud Servers Pvt Ltd remarks: ISP located in NL, all RIR data for announced prefixes contain garbage @@ -828,11 +863,26 @@ descr: Optix Pakistan (Pvt.) Limited remarks: ISP located in PK, some RIR data for announced prefixes (bogons?) contain garbage country: PK +aut-num: AS136744 +descr: DREAM POWER TECHNOLOGY LIMITED +remarks: Located somewhere in AP (HK? KR?), tampers with RIR data a lot +country: AP + +aut-num: AS136746 +descr: XRCLOUD.NET INC. +remarks: ... located in HK +country: HK + aut-num: AS136933 descr: Gigabitbank Global / Anchnet Asia Limited (?) remarks: IP hijacker located somewhere in AP area, suspected to be part of the "Asline" IP hijacking gang, tampers with RIR data country: AP +aut-num: AS136950 +descr: Hong Kong FireLine Network LTD +remarks: ... located in HK (surprise!), but thinks allocating things to random countries worldwide is funny +country: HK + aut-num: AS136988 descr: Leaseweb Australia Pty. Ltd. remarks: ISP located in AU, some RIR data for announced prefixes contain garbage @@ -843,11 +893,6 @@ descr: Anchnet Asia Limited remarks: IP hijacker located in HK, tampers with RIR data country: HK -aut-num: AS137523 -descr: HONGKONG CLOUD NETWORK TECHNOLOGY CO., LIMITED -remarks: ISP and IP hijacker located in HK, tampers with RIR data -country: HK - aut-num: AS138195 descr: MOACK.Co.LTD remarks: ISP located in KR, some RIR data for announced prefixes contain garbage @@ -878,6 +923,11 @@ descr: SANREN DATA LIMITED remarks: IP hijacker located somewhere in AP region, tampers with RIR data country: AP +aut-num: AS139471 +descr: HWA CENT TELECOMMUNICATIONS LIMITED +remarks: ISP and/or IP hijacker located in AP area, tampers with RIR data +country: AP + aut-num: AS139640 descr: HK NEW CLOUD TECHNOLOGY LIMITED remarks: ISP and/or IP hijacker located in AP area, tampers with RIR data @@ -908,6 +958,11 @@ descr: Galaxy Broadband remarks: ISP located in PK, but announces 204.137.128.0/18, which is ARIN space, assigned to "AGIS" / Cogent - odd... country: PK +aut-num: AS140214 +descr: Create Prominent Information Limited +remarks: Shady ISP located in HK +country: HK + aut-num: AS140224 descr: White-Sand Cloud Computing(HK) Co., LIMITED remarks: part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to AP region @@ -938,6 +993,11 @@ descr: FLP Kochenov Aleksej Vladislavovich remarks: ISP located in UA, but RIR data for announced prefixes all say EU country: UA +aut-num: AS197540 +descr: netcup GmbH +remarks: ISP located in DE, some RIR data for announced prefixes contain garbage +country: DE + aut-num: AS200019 descr: ALEXHOST SRL remarks: ISP located in MD, majority of RIR data for announced prefixes contain garbage, we cannot trust this network @@ -1260,8 +1320,8 @@ country: ZA aut-num: AS328608 descr: Africa on Cloud -remarks: ... for some reason, I doubt a _real_ African ISP would announce solely hijacked prefixes -country: AP +remarks: ... for some reason, I doubt a _real_ African ISP would announce solely hijacked prefixes - anyway, traces back to ZA :-/ +country: ZA aut-num: AS328703 descr: Seven Network Inc. @@ -1678,11 +1738,6 @@ descr: 4b42 UG (haftungsbeschränkt) remarks: ... who thinks assigning networks to unpopulated Bouvet Island (BV) is funny :-/ country: DE -net: 2a0f:7a80::/29 -descr: ASLINE Limited -remarks: APNIC chunk owned by a HK-based company, but assigned to DE -country: AP - net: 2a0f:e400:3000::/40 descr: Kevin Buehl remarks: ... who thinks assigning networks to unpopulated Bouvet Island (BV) is funny :-/ diff --git a/overrides/override-xd.txt b/overrides/override-xd.txt index 76ceab3..738a699 100644 --- a/overrides/override-xd.txt +++ b/overrides/override-xd.txt @@ -40,8 +40,8 @@ drop: yes aut-num: AS211849 descr: Kakharov Orinbassar Maratuly -remarks: ISP and IP hijacker located in RU, many RIR data for announced prefixes contain garbage -country: RU +remarks: ISP and IP hijacker located in KZ, many RIR data for announced prefixes contain garbage +country: KZ drop: yes aut-num: AS24009 @@ -97,6 +97,12 @@ remarks: Owned by an offshore letterbox company, suspected rogue ISP country: RU drop: yes +aut-num: AS54600 +descr: PEG TECH INC +remarks: ISP and IP hijacker located in US this time, tampers with RIR data +country: US +drop: yes + aut-num: AS55303 descr: Eagle Sky Co., Lt[d ?] remarks: Autonomous System registered to offshore company, abuse contact is a freemail address, address says "0 Market Square, P.O. Box 364, Belize", seems to trace to some location in AP vicinity @@ -166,6 +172,12 @@ remarks: IP hijacker located in HK, suspected to be part of the "Asline" IP hija country: HK drop: yes +aut-num: AS137523 +descr: HONGKONG CLOUD NETWORK TECHNOLOGY CO., LIMITED +remarks: ISP and IP hijacker located in HK, tampers with RIR data +country: HK +drop: yes + aut-num: AS137951 descr: Clayer Limited remarks: part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to HK @@ -261,6 +273,18 @@ remarks: ISP located in HK, tampers with RIR data country: HK drop: yes +aut-num: AS398993 +descr: PEG TECH INC +remarks: ISP located in JP, tampers with RIR data +country: JP +drop: yes + +aut-num: AS399195 +descr: PEG TECH INC +remarks: ISP located in KR, tampers with RIR data +country: KR +drop: yes + net: 196.11.32.0/20 descr: Sanlam Life Insurance Limited remarks: Stolen AfriNIC IPv4 space announced from NL @@ -272,6 +296,12 @@ descr: NZB.si Enterprises remarks: Tampers with RIR data, not a safe place to route traffic to drop: yes +net: 2a0f:7a80::/29 +descr: ASLINE Limited +remarks: APNIC chunk owned by a HK-based IP hijacker, but assigned to DE +country: HK +drop: yes + net: 2a10:9700::/29 descr: 1337TEAM LIMITED / eliteteam[.]to remarks: Owned by an offshore letterbox company, suspected rogue ISP -- 2.26.2

1 0

[PATCH] overrides-{a1,other,xd}: Regular batch of various overrides
by Peter Müller 06 Jan '22

06 Jan '22

Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- overrides/override-a1.txt | 26 +++----- overrides/override-other.txt | 125 +++++++++++++++++------------------ overrides/override-xd.txt | 96 +++++++++++++++++++++++++-- 3 files changed, 163 insertions(+), 84 deletions(-) diff --git a/overrides/override-a1.txt b/overrides/override-a1.txt index 7365738..5b620fe 100644 --- a/overrides/override-a1.txt +++ b/overrides/override-a1.txt @@ -34,11 +34,6 @@ descr: Maginfo remarks: VPN provider is-anonymous-proxy: yes -aut-num: AS13487 -descr: ULTRA PACKET LLC -remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… -is-anonymous-proxy: yes - aut-num: AS16255 descr: IRIDIUM PROVIDER LTD remarks: VPN provider [high confidence, but not proofed] located in RU @@ -300,21 +295,11 @@ descr: Castle VPN remarks: VPN provider is-anonymous-proxy: yes -aut-num: AS397539 -descr: LAKSH CYBERSECURITY AND DEFENSE LLC -remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… -is-anonymous-proxy: yes - aut-num: AS397685 descr: Business VPN LLC remarks: VPN provider is-anonymous-proxy: yes -aut-num: AS397770 -descr: LAKSH CYBERSECURITY AND DEFENSE LLC -remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… -is-anonymous-proxy: yes - aut-num: AS397881 descr: Stingers, Inc. remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… @@ -341,6 +326,12 @@ descr: Tunbroker LLC remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… is-anonymous-proxy: yes +aut-num: AS399587 +descr: UT +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… +is-anonymous-proxy: yes +country: US + aut-num: AS399928 descr: STELLAR PROXIES remarks: VPN or open proxy provider @@ -1174,6 +1165,11 @@ descr: IPNET-VPNS remarks: VPN provider [high confidence, but not proofed] is-anonymous-proxy: yes +net: 166.137.0.0/16 +descr: Service Provider Corporation +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… +is-anonymous-proxy: yes + net: 169.239.152.0/22 descr: AfriVPN Ltd remarks: VPN provider, traces back to ZA diff --git a/overrides/override-other.txt b/overrides/override-other.txt index 8b228af..56bb12e 100644 --- a/overrides/override-other.txt +++ b/overrides/override-other.txt @@ -82,7 +82,7 @@ remarks: has no sane AS name set in APNIC DB aut-num: AS4842 descr: Tianhai InfoTech -remarks: IP hijacker located somewhere in AP, massively tampers with RIR data +remarks: IP hijacker located somewhere in AP, tampers with RIR data country: AP aut-num: AS5408 @@ -146,18 +146,18 @@ country: US aut-num: AS15828 descr: Blue Diamond Network Co., Ltd. -remarks: Hiding behind fake ISP Navitgo LLC (AS59721), tampers with RIR data -country: NL +remarks: Shady ISP located somewhere in AP +country: AP + +aut-num: AS16262 +descr: Datacheap Ltd. +remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage +country: RU aut-num: AS18185 name: Northern Taiwan Community University remarks: has no sane AS name set in APNIC DB -aut-num: AS18254 -descr: KLAYER LLC -remarks: part of the "Asline" IP hijacking gang, traces back to AP region -country: AP - aut-num: AS18530 descr: Isomedia, Inc. remarks: ISP located in US, but some RIR data for announced prefixes contain garbage @@ -178,6 +178,11 @@ descr: xTom Pty. Ltd. remarks: ISP located in AU, RIR data for announced prefixes contain garbage country: AU +aut-num: AS24413 +descr: Sunrise +remarks: ISP located in somewhere in AP +country: AP + aut-num: AS24700 descr: Yes Networks Unlimited Ltd remarks: traces to UA, but some RIR entries seem to contain garbage (VG) @@ -258,6 +263,16 @@ descr: Petersburg Internet Network Ltd. remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage country: RU +aut-num: AS34806 +descr: ASLINE LIMITED +remarks: ... located in HK +country: HK + +aut-num: AS34985 +descr: Kirin Communication Limited +remarks: ISP located in JP, but some RIR data for announced prefixes contain garbage +country: JP + aut-num: AS35042 descr: IP Interactive UG (haftungsbeschraenkt) remarks: ISP located in BG, but RIR data for announced prefixes contain garbage @@ -568,6 +583,11 @@ descr: PEG TECH INC remarks: ISP and/or IP hijacker located in US this time, tampers with RIR data country: US +aut-num: AS55330 +descr: AFGHANTELECOM GOVERNMENT COMMUNICATION NETWORK +remarks: For some reason, some "Airbus Defence and Space AS" prefixes are announced by this one... +country: AF + aut-num: AS55836 descr: Reliance Jio Infocomm Limited remarks: ISP located in IN, but some RIR data for announced prefixes contain garbage @@ -703,6 +723,11 @@ descr: 4b42 UG (haftungsbeschränkt) remarks: ... who thinks messing with countries is funny :-/ country: LI +aut-num: AS61635 +descr: GOPLEX TELECOMUNICACOES E INTERNET LTDA - ME +remarks: ... traces back to NL +country: NL + aut-num: AS61977 descr: Vivo Trade L.P. remarks: another shady customer of "DDoS Guard Ltd." @@ -738,11 +763,6 @@ descr: SWISS GLOBAL SERVICES S.A.S. remarks: ... surprisingly, all of their prefixes are hosted in CH, yet they claim CO or PA for them country: CH -aut-num: AS64437 -descr: NForce Entertainment BV -remarks: currently hijacks a single stolen /20 AfriNIC IPv4 net, hosted in NL -country: NL - aut-num: AS131685 descr: Sun Network (Hong Kong) Limited remarks: ISP and/or IP hijacker located somewhere in AP @@ -760,8 +780,8 @@ country: HK aut-num: AS133201 descr: ABCDE GROUP COMPANY LIMITED -remarks: ISP and/or IP hijacker located somewhere in AP -country: AP +remarks: ISP and/or IP hijacker located in HK +country: HK aut-num: AS133441 descr: CloudITIDC Global @@ -779,8 +799,8 @@ remarks: IP hijacker located somewhere in AP area, suspected to be part of the " country: AP aut-num: AS134196 -descr: ULan Network Limited -remarks: part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to AP region +descr: Cloudie Limited +remarks: part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to AP region (HK? CN?) country: AP aut-num: AS134351 @@ -808,16 +828,6 @@ descr: Optix Pakistan (Pvt.) Limited remarks: ISP located in PK, some RIR data for announced prefixes (bogons?) contain garbage country: PK -aut-num: AS136545 -descr: Blue Data Center -remarks: IP hijacker located somewhere in AP area, tampers with RIR data -country: AP - -aut-num: AS136800 -descr: ICIDC NETWORK -remarks: IP hijacker located somewhere in AP, suspected to be part of the "Asline" IP hijacking gang, tampers with RIR data -country: AP - aut-num: AS136933 descr: Gigabitbank Global / Anchnet Asia Limited (?) remarks: IP hijacker located somewhere in AP area, suspected to be part of the "Asline" IP hijacking gang, tampers with RIR data @@ -835,13 +845,8 @@ country: HK aut-num: AS137523 descr: HONGKONG CLOUD NETWORK TECHNOLOGY CO., LIMITED -remarks: IP hijacker located in AP area, tampers with RIR data -country: AP - -aut-num: AS137951 -descr: Clayer Limited -remarks: part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to AP region -country: AP +remarks: ISP and IP hijacker located in HK, tampers with RIR data +country: HK aut-num: AS138195 descr: MOACK.Co.LTD @@ -923,11 +928,6 @@ descr: Full Time Hosting remarks: ISP located in DE, tampers with RIR data country: DE -aut-num: AS141159 -descr: Incomparable(HK)Network Co., Limited -remarks: ISP and/or IP hijacker located in AP area, tampers with RIR data -country: AP - aut-num: AS141746 descr: Orenji Server remarks: IP hijacker located somewhere in AP area (JP?) @@ -1153,11 +1153,6 @@ descr: JMT Paso Limited remarks: ISP located in NL, but RIR data for announced prefixes contain garbage country: NL -aut-num: AS211849 -descr: Kakharov Orinbassar Maratuly -remarks: ISP and/or IP hijacker located in RU, but RIR data for announced prefixes contain garbage -country: RU - aut-num: AS211992 descr: WFD SERVICE LTD remarks: ISP located in NL, but RIR data for announced prefixes contain garbage @@ -1238,6 +1233,11 @@ descr: Udasha S.A. remarks: traceroutes dead-end somewhere near NYC, US country: US +aut-num: AS264097 +descr: WIID TelecomunicaiÂ¿Â½iÂ¿Â½es do Brasil +remarks: ... traces back to NL +country: NL + aut-num: AS267784 descr: Flyservers S.A. remarks: ISP located in NL, but RIR data for most announced prefixes contain garbage @@ -1258,11 +1258,6 @@ descr: Xhostserver LLC remarks: ISP located in ZA, many RIR data for announced prefixes contain garbage country: ZA -aut-num: AS328543 -descr: Sun Network Company Limited -remarks: IP hijacker, traces back to AP region -country: AP - aut-num: AS328608 descr: Africa on Cloud remarks: ... for some reason, I doubt a _real_ African ISP would announce solely hijacked prefixes @@ -1293,16 +1288,16 @@ descr: Leaseweb USA, Inc. remarks: ISP located in US, but some RIR data for announced prefixes contain garbage country: US +aut-num: AS397423 +descr: Tier.Net Technologies LLC +remarks: ISP located in US, but some RIR data for announced prefixes contain garbage +country: US + aut-num: AS398343 descr: Baxet Group Inc. remarks: traceroutes dead-end near Moscow, RU country: RU -aut-num: AS398478 -descr: PEG TECH INC -remarks: ISP located in HK, tampers with RIR data -country: HK - aut-num: AS398823 descr: PEG TECH INC remarks: ISP and/or IP hijacker located in HK, tampers with RIR data @@ -1320,7 +1315,7 @@ country: HK aut-num: AS399471 descr: Serverion LLC -remarks: ISP located in NL, RIR data contain garbage +remarks: ISP located in NL, some RIR data contain garbage country: NL aut-num: AS399077 @@ -1418,26 +1413,21 @@ descr: US AFG 20200130 remarks: claims to be located in US, but traces back to SK country: SK +net: 45.155.121.0/24 +descr: Itace International Limited +remarks: claims to be located in HK, but traces back to RO +country: RO + net: 47.60.0.0/14 descr: Vodafone US Inc. remarks: large Vodafone IP chunk used in ES, but assigned by ARIN (inaccurate data) country: ES -net: 80.240.96.0/24 -descr: LLC RusTel -remarks: fake location (RU), traces back to HK -country: HK - net: 85.202.80.0/24 descr: Amarutu Technology Ltd. / KoDDoS / ESecurity remarks: fake offshore location (BZ), traces back to US country: US -net: 88.151.117.0/24 -descr: Golden Internet LLC -remarks: fake location (KP), WHOIS contact points to RU -country: RU - net: 91.90.120.0/24 descr: M247 LTD, Greenland Infrastructure remarks: ... traces back to CA @@ -1588,6 +1578,11 @@ descr: NetConn Services Ltd remarks: APNIC chunk owned by a HK-based company, routed to AP region, but assigned to SC country: AP +net: 193.176.24.0/22 +descr: REACOM GmbH +remarks: The entire network is used out of RU +country: RU + net: 193.186.196.0/22 descr: QUIKA LTD remarks: claims to be located in DE, traces back to GB diff --git a/overrides/override-xd.txt b/overrides/override-xd.txt index b669621..76ceab3 100644 --- a/overrides/override-xd.txt +++ b/overrides/override-xd.txt @@ -26,16 +26,34 @@ # Please keep this file sorted. # +aut-num: AS18254 +descr: KLAYER LLC +remarks: part of the "Asline" IP hijacking gang, traces back to AP region +country: AP +drop: yes + aut-num: AS18013 descr: ASLINE LIMITED -remarks: IP hijacker, traces back to AP region -country: AP +remarks: IP hijacker, traces back to HK +country: HK +drop: yes + +aut-num: AS211849 +descr: Kakharov Orinbassar Maratuly +remarks: ISP and IP hijacker located in RU, many RIR data for announced prefixes contain garbage +country: RU +drop: yes + +aut-num: AS24009 +descr: LANLIAN INTERNATIONAL HOLDING GROUP LIMITED +remarks: IP hijacker and bulletproof ISP, possibly located near Los Angeles, US +country: US drop: yes aut-num: AS22769 descr: DDOSING NETWORK -remarks: IP hijacker located somewhere in AP, massively tampers with RIR data -country: AP +remarks: IP hijacker located in US, massively tampers with RIR data +country: US drop: yes aut-num: AS24009 @@ -119,6 +137,11 @@ descr: 1337TEAM LIMITED / eliteteam[.]to remarks: Owned by an offshore letterbox company, suspected rogue ISP drop: yes +aut-num: AS61414 +descr: EDGENAP LTD +remarks: IP hijacking? Rogue ISP? +drop: yes + aut-num: AS62068 descr: SpectraIP B.V. remarks: bulletproof ISP (linked to AS202425 et al.) located in NL @@ -131,6 +154,41 @@ remarks: bulletproof ISP (linked to AS202425 et al.) located in NL country: NL drop: yes +aut-num: AS136545 +descr: Blue Data Center +remarks: IP hijacker located somewhere in AP area, tampers with RIR data +country: AP +drop: yes + +aut-num: AS136800 +descr: ICIDC NETWORK +remarks: IP hijacker located in HK, suspected to be part of the "Asline" IP hijacking gang, tampers with RIR data +country: HK +drop: yes + +aut-num: AS137951 +descr: Clayer Limited +remarks: part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to HK +country: HK +drop: yes + +aut-num: AS138648 +descr: ASLINE Global Exchange +remarks: IP hijacker located somewhere in AP area +country: AP +drop: yes + +aut-num: AS140107 +descr: CITIS CLOUD GROUP LIMITED +remarks: part of the "Asline" IP hijacking gang, tampers with RIR data, location unknown (AP? HK? US?) +drop: yes + +aut-num: AS141159 +descr: Incomparable(HK)Network Co., Limited +remarks: ISP and IP hijacker located in HK, tampers with RIR data +country: HK +drop: yes + aut-num: AS200391 descr: KREZ 999 EOOD remarks: another shady customer of "Tamatiya EOOD / 4Vendeta", located in BG, tampers with RIR data @@ -149,6 +207,12 @@ remarks: bulletproof ISP and IP hijacker, related to AS202425 and AS62355, trace country: NL drop: yes +aut-num: AS204428 +descr: SS-Net +remarks: another shady customer of "Tamatiya EOOD / 4Vendeta", located in BG, tampers with RIR data +country: BG +drop: yes + aut-num: AS204655 descr: Novogara Ltd. remarks: bulletproof ISP (strongly linked to AS202425) located in NL @@ -167,18 +231,42 @@ remarks: bulletproof ISP operating from a war zone in eastern UA country: UA drop: yes +aut-num: AS211193 +descr: ABDILAZIZ UULU ZHUSUP +remarks: bulletproof ISP and IP hijacker, traces to RU +country: RU +drop: yes + aut-num: AS213058 descr: Private Internet Hosting LTD remarks: bulletproof ISP located in RU country: RU drop: yes +aut-num: AS328543 +descr: Sun Network Company Limited +remarks: IP hijacker, traces back to AP region +country: AP +drop: yes + aut-num: AS328671 descr: Datapacket Maroc SARL remarks: bulletproof ISP (strongly linked to AS202425) located in NL country: NL drop: yes +aut-num: AS398478 +descr: PEG TECH INC +remarks: ISP located in HK, tampers with RIR data +country: HK +drop: yes + +net: 196.11.32.0/20 +descr: Sanlam Life Insurance Limited +remarks: Stolen AfriNIC IPv4 space announced from NL +country: NL +drop: yes + net: 2a0e:b107:d10::/44 descr: NZB.si Enterprises remarks: Tampers with RIR data, not a safe place to route traffic to -- 2.26.2

1 0

2024

2023

2022

2021

2020

2019

2018

2017

Location January 2022