- Location - lists.ipfire.org

[PATCH] override-{a3,other,xd}: Regular batch of various overrides
by Peter Müller 04 Feb '22

04 Feb '22

Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- overrides/override-a3.txt | 5 ++++ overrides/override-other.txt | 44 ++++++++++++++++++++++++++++++++++-- overrides/override-xd.txt | 5 ++++ 3 files changed, 52 insertions(+), 2 deletions(-) diff --git a/overrides/override-a3.txt b/overrides/override-a3.txt index 6b8f886..ce51889 100644 --- a/overrides/override-a3.txt +++ b/overrides/override-a3.txt @@ -208,6 +208,11 @@ descr: coreIT.pl remarks: Generic anycast network is-anycast: yes +aut-num: AS59796 +descr: StormWall s.r.o. +remarks: Worldwide active CDN +is-anycast: yes + aut-num: AS60626 descr: Leaseweb CDN B.V. remarks: Generic anycast network diff --git a/overrides/override-other.txt b/overrides/override-other.txt index a8faabf..b74c1e3 100644 --- a/overrides/override-other.txt +++ b/overrides/override-other.txt @@ -161,14 +161,19 @@ country: IR aut-num: AS15828 descr: Blue Diamond Network Co., Ltd. -remarks: Shady ISP located somewhere in AP -country: AP +remarks: Shady ISP, claims GB or IR for it's prefixes, but they all end up near Vilnius, LT +country: LT aut-num: AS16262 descr: Datacheap Ltd. remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage country: RU +aut-num: AS17447 +descr: Net4India Ltd +remarks: Serverion customer in NL, many RIR data for announced prefixes contain garbage +country: NL + aut-num: AS18185 name: Northern Taiwan Community University remarks: has no sane AS name set in APNIC DB @@ -188,6 +193,11 @@ descr: ITL LLC remarks: ISP headquatered in BG and/or UA, physically located in NL, some RIR data for announced prefixes contain inaccurate data country: NL +aut-num: AS23470 +descr: ReliableSite.Net LLC +remarks: ISP located in US, but RIR data for announced prefixes contain garbage +country: US + aut-num: AS23858 descr: xTom Pty. Ltd. remarks: ISP located in AU, RIR data for announced prefixes contain garbage @@ -793,6 +803,11 @@ descr: Sun Network (Hong Kong) Limited remarks: ISP and/or IP hijacker located somewhere in AP country: AP +aut-num: AS132335 +descr: LeapSwitch Networks Pvt Ltd +remarks: ISP and/or IP hijacker located in IN +country: IN + aut-num: AS132369 descr: XIANGAO INTERNATIONAL TELECOMMUNICATION LIMITED remarks: ISP located in HK, tampers with RIR data @@ -1198,6 +1213,11 @@ descr: Packet Flip, LLC remarks: ISP located in US, but some RIR data for announced prefixes contain garbage country: US +aut-num: AS209654 +descr: Delis LLC +remarks: Shary Serverion customer in NL, many RIR data for announced prefixes contain garbage +country: NL + aut-num: AS210119 descr: VPSSC Networks LTD remarks: ISP located in UA, but RIR data for announced prefixes contain garbage @@ -1208,6 +1228,11 @@ descr: Des Capital B.V. remarks: Shady ISP located in NL, but RIR data for announced prefixes contain garbage country: NL +aut-num: AS211252 +descr: Delis LLC +remarks: Shary Serverion customer in NL, many RIR data for announced prefixes contain garbage +country: NL + aut-num: AS211380 descr: PAYWISE HOLDING Sp. z.o.o. remarks: ISP located in NL, but RIR data for announced prefixes contain garbage @@ -1388,6 +1413,11 @@ descr: Wolverine Trading, LLC remarks: IP hijacker located in US, tampers with RIR data country: US +aut-num: AS400377 +descr: Serverion LLC +remarks: ISP located in NL, some RIR data contain garbage +country: NL + net: 5.1.68.0/24 descr: GaiacomLC remarks: routed to DE, inaccurate RIR data @@ -1598,6 +1628,11 @@ descr: Hornetsecurity GmbH remarks: all suballocations are used in DE, but are assigned to US country: DE +net: 185.143.223.0/24 +descr: Lenar Davletshin +remarks: traceroutes dead-end somewhere after entering Voxility's network in Vienna, but that's not the location of this network +country: EU + net: 185.175.93.0/24 descr: Perfect Hosting Solutions remarks: bulletproof ISP related to AS204655, traces back to BG @@ -1653,6 +1688,11 @@ descr: QUIKA LTD remarks: claims to be located in DE, traces back to GB country: GB +net: 194.87.218.0/24 +descr: Hauer Hosting Services Limited +remarks: traces back to RU +country: RU + net: 195.66.165.0/24 descr: Posta Crne Gore remarks: Orphaned RIR data, see: https://lists.ipfire.org/pipermail/location/2021-April/000267.html diff --git a/overrides/override-xd.txt b/overrides/override-xd.txt index 2b50406..131e24d 100644 --- a/overrides/override-xd.txt +++ b/overrides/override-xd.txt @@ -138,6 +138,11 @@ descr: 1337TEAM LIMITED / eliteteam[.]to remarks: Owned by an offshore letterbox company, suspected rogue ISP drop: yes +aut-num: AS57523 +descr: Chang Way Technologies Co. Limited +remarks: bulletproof ISP, C&C server hosting galore +drop: yes + aut-num: AS57717 descr: FiberXpress BV remarks: bulletproof ISP (related to AS202425) located in NL -- 2.34.1

1 0

ASNs without AS name information (LACNIC and JPNIC)
by nusenu 19 Jan '22

19 Jan '22

Hi, I'm currently evaluating whether I should use ipfire or RIPEstat for AS information. (low number of lookups, lookup latency is not an issue) For tor relay IPs I found 54 ASNs where ipfire's DB has no AS name information. These are likely related to LACNIC and JPNIC. Are there plans to add AS names for these regions as well or will this not improve in the near future (before 2022)? kind regards, nusenu +-----------+---------+ | as_number | country | +-----------+---------+ | AS61493 | ar | | AS7303 | ar | | AS18881 | br | | AS19182 | br | | AS262287 | br | | AS264381 | br | | AS267436 | br | | AS268207 | br | | AS269070 | br | | AS27699 | br | | AS27715 | br | | AS28126 | br | | AS28271 | br | | AS28573 | br | | AS28668 | br | | AS53024 | br | | AS53111 | br | | AS53187 | br | | AS7162 | br | | AS7738 | br | | AS8167 | br | | AS22047 | cl | | AS265831 | cl | | AS270013 | cl | | AS27651 | cl | | AS52368 | cl | | AS64111 | cl | | AS7418 | cl | | AS13489 | co | | AS11830 | cr | | AS3790 | cr | | AS52423 | cr | | AS28118 | do | | AS10010 | jp | | AS17676 | jp | | AS18126 | jp | | AS2510 | jp | | AS2514 | jp | | AS2516 | jp | | AS2527 | jp | | AS4685 | jp | | AS4694 | jp | | AS4713 | jp | | AS4725 | jp | | AS59103 | jp | | AS7506 | jp | | AS7684 | jp | | AS9370 | jp | | AS9371 | jp | | AS13999 | mx | | AS278 | mx | | AS6503 | mx | | AS8151 | mx | | AS27956 | pa | +-----------+---------+

3 11

[PATCH v2] override-{a1, other, xd}: Regular batch of various overrides
by Peter Müller 16 Jan '22

16 Jan '22

The second version of this patch keeps a necessary override for AS207812, which was mistakenly deleted completely in the first version. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- overrides/override-a1.txt | 5 ++ overrides/override-other.txt | 97 +++++++++++++++++++----------------- overrides/override-xd.txt | 66 +++++++++++++++++++++--- 3 files changed, 116 insertions(+), 52 deletions(-) diff --git a/overrides/override-a1.txt b/overrides/override-a1.txt index 43e0174..a97e7ce 100644 --- a/overrides/override-a1.txt +++ b/overrides/override-a1.txt @@ -639,6 +639,11 @@ descr: Gabor Marton remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… is-anonymous-proxy: yes +net: 45.203.128.0/18 +descr: ProxyWow LLC +remarks: CloudInnovation space leased to "ProxyWow LLC" - not a safe area to accept traffic from anyways +is-anonymous-proxy: yes + net: 45.220.72.0/22 descr: Low budget VPN service remarks: VPN provider diff --git a/overrides/override-other.txt b/overrides/override-other.txt index 89ad8e0..a8faabf 100644 --- a/overrides/override-other.txt +++ b/overrides/override-other.txt @@ -63,6 +63,11 @@ aut-num: AS4134 name: Chinanet Backbone remarks: has no sane AS name set in APNIC DB +aut-num: AS4609 +descr: Companhia de Telecomunicacones de Macau SARL +remarks: ISP located in MO, but some RIR data needs manual correction due to ARIN DB situation +country: MO + aut-num: AS4754 name: Software Technology Park of India remarks: has no sane AS name set in APNIC DB @@ -90,6 +95,11 @@ descr: Greek Research and Technology Network (GRNET) S.A. remarks: ... located in GR country: GR +aut-num: AS6079 +descr: RCN +remarks: ISP located in US, but some RIR data for announced prefixes contain garbage +country: US + aut-num: AS6134 descr: XNNET LLC remarks: traces back to HK, seems to tamper with RIR data @@ -208,6 +218,11 @@ descr: Unicycle, LLC remarks: traces back to NL country: NL +aut-num: AS26548 +descr: PureVoltage Hosting Inc. +remarks: ISP and IP hijacker located in US, but some RIR data for announced prefixes contain garbage +country: US + aut-num: AS26636 descr: GBTCloud, Inc. remarks: ISP located in US, but some RIR data for announced prefixes contain garbage @@ -263,6 +278,11 @@ descr: Neterra Ltd. remarks: ISP located in BG, but some RIR data for announced prefixes contain garbage country: BG +aut-num: AS34549 +descr: meerfarbig GmbH & Co. KG +remarks: ISP located in DE, but some RIR data for announced prefixes contain garbage +country: DE + aut-num: AS34665 descr: Petersburg Internet Network Ltd. remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage @@ -388,10 +408,10 @@ descr: MLAB Open Source Community remarks: traces back to DE country: DE -aut-num: AS41564 -descr: Orion Network Limited -remarks: shady uplink for a bunch of dirty ISPs in SE (and likely elsewhere in EU), routing stolen AfriNIC networks, RIR data of prefixes announced by this AS cannot be trusted -country: SE +aut-num: AS41378 +descr: Kirino LLC +remarks: traces back to AP vincinity, tampers with RIR data +country: AP aut-num: AS41608 descr: NextGenWebs, S.L. @@ -603,11 +623,6 @@ descr: Reliance Jio Infocomm Limited remarks: ISP located in IN, but some RIR data for announced prefixes contain garbage country: IN -aut-num: AS55933 -descr: Cloudie Limited -remarks: part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to AP region -country: AP - aut-num: AS56322 descr: ServerAstra Kft. remarks: ISP located in HU, but some RIR data for announced prefixes contain garbage @@ -633,16 +648,6 @@ descr: Telefonica LLC remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage country: RU -aut-num: AS57858 -descr: Inter Connects Inc. -remarks: part of a dirty ISP conglomerate operating most likely out of SE, hijacking stolen AfriNIC networks, massively tampers with RIR data -country: SE - -aut-num: AS57972 -descr: Inter Connects Inc. -remarks: part of a dirty ISP conglomerate operating most likely out of SE, hijacking stolen AfriNIC networks, massively tampers with RIR data -country: SE - aut-num: AS58061 descr: Scalaxy B.V. remarks: ISP located in NL, but some RIR data for announced prefixes contain garbage @@ -665,8 +670,8 @@ country: BG aut-num: AS58349 descr: INNETRA PC -remarks: another shady customer of "DDoS Guard Ltd.", jurisdiction is probably RU, but traceroutes dead-end somewhere else in EU -country: EU +remarks: ... traceroutes dead-end in NL +country: NL aut-num: AS58879 descr: Shanghai Anchang Network Security Technology Co.,Ltd. @@ -723,11 +728,6 @@ descr: DignusData LLC remarks: ISP located in PL, but _all_ RIR data for announced prefixes contain garbage country: PL -aut-num: AS60485 -descr: Inter Connects Inc. / Jing Yun -remarks: part of a dirty ISP conglomerate operating most likely out of SE, hijacking AfriNIC networks -country: SE - aut-num: AS60546 descr: EU Routing Ltd remarks: fake offshore location (CY), hosted in NL @@ -818,6 +818,11 @@ descr: CloudITIDC Global remarks: ISP and/or IP hijacker located somewhere in AP country: AP +aut-num: AS133613 +descr: MTel telecommunication company ltd. +remarks: ISP and located in MO, but some prefixes needs manual correction due to ARIN DB situation +country: MO + aut-num: AS133752 descr: Leaseweb Asia Pacific pte. ltd. remarks: ISP located in HK, some RIR data for announced prefixes contain garbage @@ -853,6 +858,11 @@ descr: LUOGELANG (FRANCE) LIMITED remarks: Shady ISP located in HK, RIR data for announced prefixes contain garbage country: HK +aut-num: AS136167 +descr: China Telecom (Macau) Company Limited +remarks: located in MO, yet some prefixes show CN or HK instead +country: MO + aut-num: AS136274 descr: Cloud Servers Pvt Ltd remarks: ISP located in NL, all RIR data for announced prefixes contain garbage @@ -918,11 +928,6 @@ descr: Cloudflare Sydney, LLC remarks: ... but CF failed to set the country for announced prefixes to AU as well :-/ country: AU -aut-num: AS139330 -descr: SANREN DATA LIMITED -remarks: IP hijacker located somewhere in AP region, tampers with RIR data -country: AP - aut-num: AS139471 descr: HWA CENT TELECOMMUNICATIONS LIMITED remarks: ISP and/or IP hijacker located in AP area, tampers with RIR data @@ -955,7 +960,7 @@ country: HK aut-num: AS139879 descr: Galaxy Broadband -remarks: ISP located in PK, but announces 204.137.128.0/18, which is ARIN space, assigned to "AGIS" / Cogent - odd... +remarks: ISP located in PK, but some RIR data need manual correction due to ARIN DB situation country: PK aut-num: AS140214 @@ -983,10 +988,10 @@ descr: Full Time Hosting remarks: ISP located in DE, tampers with RIR data country: DE -aut-num: AS141746 -descr: Orenji Server -remarks: IP hijacker located somewhere in AP area (JP?) -country: AP +aut-num: AS141677 +descr: Nathosts Limited +remarks: ... located in HK? +country: HK aut-num: AS196682 descr: FLP Kochenov Aleksej Vladislavovich @@ -1138,6 +1143,11 @@ descr: Inteldome Corporation remarks: ... whose location we are unable to determine precisely, but its definitely not MH :-/ country: EU +aut-num: AS207812 +descr: DM AUTO EOOD +remarks: another shady customer of "Tamatiya EOOD / 4Vendeta", located in BG, tampers with RIR data +country: BG + aut-num: AS207968 descr: Internetservice Hahn remarks: AQ != DE, you know @@ -1198,11 +1208,6 @@ descr: Des Capital B.V. remarks: Shady ISP located in NL, but RIR data for announced prefixes contain garbage country: NL -aut-num: AS210848 -descr: Telkom Internet LTD -remarks: shady ISP currently located in NL -country: NL - aut-num: AS211380 descr: PAYWISE HOLDING Sp. z.o.o. remarks: ISP located in NL, but RIR data for announced prefixes contain garbage @@ -1248,11 +1253,6 @@ descr: MILEGROUP LTD remarks: traceroutes dead-end somewhere in Central Europe country: EU -aut-num: AS212552 -descr: BitCommand LLC -remarks: Hides behind a CDN ISP, traceroutes dead-end somewhere in Central Europe -country: EU - aut-num: AS212667 descr: RECONN LLC remarks: ISP located in RU, but RIR data for announced prefixes contain garbage @@ -1533,6 +1533,11 @@ descr: SpaceX Canada Corp. remarks: Accurate country code missing due to ARIN DB situation, see also: #12746 country: CA +net: 103.126.4.0/23 +descr: Cyber Telecom ISP +remarks: Despite being allocated to AF, traceroutes end in NL +country: NL + net: 103.197.148.0/22 descr: I.C.S. Trabia-Network S.R.L. remarks: fake offshore location (HK), traces back to MD diff --git a/overrides/override-xd.txt b/overrides/override-xd.txt index 738a699..2b50406 100644 --- a/overrides/override-xd.txt +++ b/overrides/override-xd.txt @@ -67,6 +67,12 @@ descr: 1337TEAM LIMITED / eliteteam[.]to remarks: Owned by an offshore letterbox company, suspected rogue ISP drop: yes +aut-num: AS41564 +descr: Orion Network Limited +remarks: shady uplink for a bunch of dirty ISPs in SE (and likely elsewhere in EU), routing stolen AfriNIC networks, RIR data of prefixes announced by this AS cannot be trusted +country: EU +drop: yes + aut-num: AS43092 descr: Kirin Communication Limited remarks: Hijacks IP space and tampers with RIR data, traces back to JP @@ -79,6 +85,12 @@ remarks: bulletproof ISP with strong links to RU country: RU drop: yes +aut-num: AS44446 +descr: OOO SibirInvest +remarks: bulletproof ISP (related to AS202425 and AS57717) located in NL +country: NL +drop: yes + aut-num: AS48090 descr: PPTECHNOLOGY LIMITED remarks: bulletproof ISP (related to AS204655) located in NL @@ -109,6 +121,12 @@ remarks: Autonomous System registered to offshore company, abuse contact is a fr country: AP drop: yes +aut-num: AS55933 +descr: Cloudie Limited +remarks: part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to AP region +country: AP +drop: yes + aut-num: AS56611 descr: REBA Communications BV remarks: bulletproof ISP (related to AS202425) located in NL @@ -126,6 +144,18 @@ remarks: bulletproof ISP (related to AS202425) located in NL country: NL drop: yes +aut-num: AS57858 +descr: Inter Connects Inc. +remarks: part of a dirty ISP conglomerate operating most likely out of SE, hijacking stolen AfriNIC networks, massively tampers with RIR data +country: SE +drop: yes + +aut-num: AS57972 +descr: Inter Connects Inc. +remarks: part of a dirty ISP conglomerate operating most likely out of SE, hijacking stolen AfriNIC networks, massively tampers with RIR data +country: SE +drop: yes + aut-num: AS58271 descr: FOP Gubina Lubov Petrivna remarks: bulletproof ISP operating from a war zone in eastern UA @@ -143,6 +173,12 @@ descr: 1337TEAM LIMITED / eliteteam[.]to remarks: Owned by an offshore letterbox company, suspected rogue ISP drop: yes +aut-num: AS60485 +descr: Inter Connects Inc. / Jing Yun +remarks: part of a dirty ISP conglomerate operating most likely out of SE, hijacking AfriNIC networks +country: SE +drop: yes + aut-num: AS61414 descr: EDGENAP LTD remarks: IP hijacking? Rogue ISP? @@ -190,6 +226,12 @@ remarks: IP hijacker located somewhere in AP area country: AP drop: yes +aut-num: AS139330 +descr: SANREN DATA LIMITED +remarks: IP hijacker located somewhere in AP region, tampers with RIR data +country: AP +drop: yes + aut-num: AS140107 descr: CITIS CLOUD GROUP LIMITED remarks: part of the "Asline" IP hijacking gang, tampers with RIR data, location unknown (AP? HK? US?) @@ -201,6 +243,12 @@ remarks: ISP and IP hijacker located in HK, tampers with RIR data country: HK drop: yes +aut-num: AS141746 +descr: Orenji Server +remarks: IP hijacker located somewhere in AP area (JP?) +country: AP +drop: yes + aut-num: AS200391 descr: KREZ 999 EOOD remarks: another shady customer of "Tamatiya EOOD / 4Vendeta", located in BG, tampers with RIR data @@ -231,24 +279,30 @@ remarks: bulletproof ISP (strongly linked to AS202425) located in NL country: NL drop: yes -aut-num: AS207812 -descr: DM AUTO EOOD -remarks: another shady customer of "Tamatiya EOOD / 4Vendeta", located in BG, tampers with RIR data -country: BG -drop: yes - aut-num: AS209272 descr: Alviva Holding Limited remarks: bulletproof ISP operating from a war zone in eastern UA country: UA drop: yes +aut-num: AS210848 +descr: Telkom Internet LTD +remarks: Rogue ISP (linked to AS202425) located in NL +country: NL +drop: yes + aut-num: AS211193 descr: ABDILAZIZ UULU ZHUSUP remarks: bulletproof ISP and IP hijacker, traces to RU country: RU drop: yes +aut-num: AS212552 +descr: BitCommand LLC +remarks: Dirty ISP located somewhere in EU, cannot trust RIR data of this network +country: EU +drop: yes + aut-num: AS213058 descr: Private Internet Hosting LTD remarks: bulletproof ISP located in RU -- 2.31.1

1 0

[PATCH] override-{a1,other,xd}: Regular batch of various overrides
by Peter Müller 16 Jan '22

16 Jan '22

Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- overrides/override-a1.txt | 5 ++ overrides/override-other.txt | 92 ++++++++++++++++++------------------ overrides/override-xd.txt | 66 +++++++++++++++++++++++--- 3 files changed, 111 insertions(+), 52 deletions(-) diff --git a/overrides/override-a1.txt b/overrides/override-a1.txt index 43e0174..a97e7ce 100644 --- a/overrides/override-a1.txt +++ b/overrides/override-a1.txt @@ -639,6 +639,11 @@ descr: Gabor Marton remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… is-anonymous-proxy: yes +net: 45.203.128.0/18 +descr: ProxyWow LLC +remarks: CloudInnovation space leased to "ProxyWow LLC" - not a safe area to accept traffic from anyways +is-anonymous-proxy: yes + net: 45.220.72.0/22 descr: Low budget VPN service remarks: VPN provider diff --git a/overrides/override-other.txt b/overrides/override-other.txt index 89ad8e0..c33e642 100644 --- a/overrides/override-other.txt +++ b/overrides/override-other.txt @@ -63,6 +63,11 @@ aut-num: AS4134 name: Chinanet Backbone remarks: has no sane AS name set in APNIC DB +aut-num: AS4609 +descr: Companhia de Telecomunicacones de Macau SARL +remarks: ISP located in MO, but some RIR data needs manual correction due to ARIN DB situation +country: MO + aut-num: AS4754 name: Software Technology Park of India remarks: has no sane AS name set in APNIC DB @@ -90,6 +95,11 @@ descr: Greek Research and Technology Network (GRNET) S.A. remarks: ... located in GR country: GR +aut-num: AS6079 +descr: RCN +remarks: ISP located in US, but some RIR data for announced prefixes contain garbage +country: US + aut-num: AS6134 descr: XNNET LLC remarks: traces back to HK, seems to tamper with RIR data @@ -208,6 +218,11 @@ descr: Unicycle, LLC remarks: traces back to NL country: NL +aut-num: AS26548 +descr: PureVoltage Hosting Inc. +remarks: ISP and IP hijacker located in US, but some RIR data for announced prefixes contain garbage +country: US + aut-num: AS26636 descr: GBTCloud, Inc. remarks: ISP located in US, but some RIR data for announced prefixes contain garbage @@ -263,6 +278,11 @@ descr: Neterra Ltd. remarks: ISP located in BG, but some RIR data for announced prefixes contain garbage country: BG +aut-num: AS34549 +descr: meerfarbig GmbH & Co. KG +remarks: ISP located in DE, but some RIR data for announced prefixes contain garbage +country: DE + aut-num: AS34665 descr: Petersburg Internet Network Ltd. remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage @@ -388,10 +408,10 @@ descr: MLAB Open Source Community remarks: traces back to DE country: DE -aut-num: AS41564 -descr: Orion Network Limited -remarks: shady uplink for a bunch of dirty ISPs in SE (and likely elsewhere in EU), routing stolen AfriNIC networks, RIR data of prefixes announced by this AS cannot be trusted -country: SE +aut-num: AS41378 +descr: Kirino LLC +remarks: traces back to AP vincinity, tampers with RIR data +country: AP aut-num: AS41608 descr: NextGenWebs, S.L. @@ -603,11 +623,6 @@ descr: Reliance Jio Infocomm Limited remarks: ISP located in IN, but some RIR data for announced prefixes contain garbage country: IN -aut-num: AS55933 -descr: Cloudie Limited -remarks: part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to AP region -country: AP - aut-num: AS56322 descr: ServerAstra Kft. remarks: ISP located in HU, but some RIR data for announced prefixes contain garbage @@ -633,16 +648,6 @@ descr: Telefonica LLC remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage country: RU -aut-num: AS57858 -descr: Inter Connects Inc. -remarks: part of a dirty ISP conglomerate operating most likely out of SE, hijacking stolen AfriNIC networks, massively tampers with RIR data -country: SE - -aut-num: AS57972 -descr: Inter Connects Inc. -remarks: part of a dirty ISP conglomerate operating most likely out of SE, hijacking stolen AfriNIC networks, massively tampers with RIR data -country: SE - aut-num: AS58061 descr: Scalaxy B.V. remarks: ISP located in NL, but some RIR data for announced prefixes contain garbage @@ -665,8 +670,8 @@ country: BG aut-num: AS58349 descr: INNETRA PC -remarks: another shady customer of "DDoS Guard Ltd.", jurisdiction is probably RU, but traceroutes dead-end somewhere else in EU -country: EU +remarks: ... traceroutes dead-end in NL +country: NL aut-num: AS58879 descr: Shanghai Anchang Network Security Technology Co.,Ltd. @@ -723,11 +728,6 @@ descr: DignusData LLC remarks: ISP located in PL, but _all_ RIR data for announced prefixes contain garbage country: PL -aut-num: AS60485 -descr: Inter Connects Inc. / Jing Yun -remarks: part of a dirty ISP conglomerate operating most likely out of SE, hijacking AfriNIC networks -country: SE - aut-num: AS60546 descr: EU Routing Ltd remarks: fake offshore location (CY), hosted in NL @@ -818,6 +818,11 @@ descr: CloudITIDC Global remarks: ISP and/or IP hijacker located somewhere in AP country: AP +aut-num: AS133613 +descr: MTel telecommunication company ltd. +remarks: ISP and located in MO, but some prefixes needs manual correction due to ARIN DB situation +country: MO + aut-num: AS133752 descr: Leaseweb Asia Pacific pte. ltd. remarks: ISP located in HK, some RIR data for announced prefixes contain garbage @@ -853,6 +858,11 @@ descr: LUOGELANG (FRANCE) LIMITED remarks: Shady ISP located in HK, RIR data for announced prefixes contain garbage country: HK +aut-num: AS136167 +descr: China Telecom (Macau) Company Limited +remarks: located in MO, yet some prefixes show CN or HK instead +country: MO + aut-num: AS136274 descr: Cloud Servers Pvt Ltd remarks: ISP located in NL, all RIR data for announced prefixes contain garbage @@ -918,11 +928,6 @@ descr: Cloudflare Sydney, LLC remarks: ... but CF failed to set the country for announced prefixes to AU as well :-/ country: AU -aut-num: AS139330 -descr: SANREN DATA LIMITED -remarks: IP hijacker located somewhere in AP region, tampers with RIR data -country: AP - aut-num: AS139471 descr: HWA CENT TELECOMMUNICATIONS LIMITED remarks: ISP and/or IP hijacker located in AP area, tampers with RIR data @@ -955,7 +960,7 @@ country: HK aut-num: AS139879 descr: Galaxy Broadband -remarks: ISP located in PK, but announces 204.137.128.0/18, which is ARIN space, assigned to "AGIS" / Cogent - odd... +remarks: ISP located in PK, but some RIR data need manual correction due to ARIN DB situation country: PK aut-num: AS140214 @@ -983,10 +988,10 @@ descr: Full Time Hosting remarks: ISP located in DE, tampers with RIR data country: DE -aut-num: AS141746 -descr: Orenji Server -remarks: IP hijacker located somewhere in AP area (JP?) -country: AP +aut-num: AS141677 +descr: Nathosts Limited +remarks: ... located in HK? +country: HK aut-num: AS196682 descr: FLP Kochenov Aleksej Vladislavovich @@ -1198,11 +1203,6 @@ descr: Des Capital B.V. remarks: Shady ISP located in NL, but RIR data for announced prefixes contain garbage country: NL -aut-num: AS210848 -descr: Telkom Internet LTD -remarks: shady ISP currently located in NL -country: NL - aut-num: AS211380 descr: PAYWISE HOLDING Sp. z.o.o. remarks: ISP located in NL, but RIR data for announced prefixes contain garbage @@ -1248,11 +1248,6 @@ descr: MILEGROUP LTD remarks: traceroutes dead-end somewhere in Central Europe country: EU -aut-num: AS212552 -descr: BitCommand LLC -remarks: Hides behind a CDN ISP, traceroutes dead-end somewhere in Central Europe -country: EU - aut-num: AS212667 descr: RECONN LLC remarks: ISP located in RU, but RIR data for announced prefixes contain garbage @@ -1533,6 +1528,11 @@ descr: SpaceX Canada Corp. remarks: Accurate country code missing due to ARIN DB situation, see also: #12746 country: CA +net: 103.126.4.0/23 +descr: Cyber Telecom ISP +remarks: Despite being allocated to AF, traceroutes end in NL +country: NL + net: 103.197.148.0/22 descr: I.C.S. Trabia-Network S.R.L. remarks: fake offshore location (HK), traces back to MD diff --git a/overrides/override-xd.txt b/overrides/override-xd.txt index 738a699..2b50406 100644 --- a/overrides/override-xd.txt +++ b/overrides/override-xd.txt @@ -67,6 +67,12 @@ descr: 1337TEAM LIMITED / eliteteam[.]to remarks: Owned by an offshore letterbox company, suspected rogue ISP drop: yes +aut-num: AS41564 +descr: Orion Network Limited +remarks: shady uplink for a bunch of dirty ISPs in SE (and likely elsewhere in EU), routing stolen AfriNIC networks, RIR data of prefixes announced by this AS cannot be trusted +country: EU +drop: yes + aut-num: AS43092 descr: Kirin Communication Limited remarks: Hijacks IP space and tampers with RIR data, traces back to JP @@ -79,6 +85,12 @@ remarks: bulletproof ISP with strong links to RU country: RU drop: yes +aut-num: AS44446 +descr: OOO SibirInvest +remarks: bulletproof ISP (related to AS202425 and AS57717) located in NL +country: NL +drop: yes + aut-num: AS48090 descr: PPTECHNOLOGY LIMITED remarks: bulletproof ISP (related to AS204655) located in NL @@ -109,6 +121,12 @@ remarks: Autonomous System registered to offshore company, abuse contact is a fr country: AP drop: yes +aut-num: AS55933 +descr: Cloudie Limited +remarks: part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to AP region +country: AP +drop: yes + aut-num: AS56611 descr: REBA Communications BV remarks: bulletproof ISP (related to AS202425) located in NL @@ -126,6 +144,18 @@ remarks: bulletproof ISP (related to AS202425) located in NL country: NL drop: yes +aut-num: AS57858 +descr: Inter Connects Inc. +remarks: part of a dirty ISP conglomerate operating most likely out of SE, hijacking stolen AfriNIC networks, massively tampers with RIR data +country: SE +drop: yes + +aut-num: AS57972 +descr: Inter Connects Inc. +remarks: part of a dirty ISP conglomerate operating most likely out of SE, hijacking stolen AfriNIC networks, massively tampers with RIR data +country: SE +drop: yes + aut-num: AS58271 descr: FOP Gubina Lubov Petrivna remarks: bulletproof ISP operating from a war zone in eastern UA @@ -143,6 +173,12 @@ descr: 1337TEAM LIMITED / eliteteam[.]to remarks: Owned by an offshore letterbox company, suspected rogue ISP drop: yes +aut-num: AS60485 +descr: Inter Connects Inc. / Jing Yun +remarks: part of a dirty ISP conglomerate operating most likely out of SE, hijacking AfriNIC networks +country: SE +drop: yes + aut-num: AS61414 descr: EDGENAP LTD remarks: IP hijacking? Rogue ISP? @@ -190,6 +226,12 @@ remarks: IP hijacker located somewhere in AP area country: AP drop: yes +aut-num: AS139330 +descr: SANREN DATA LIMITED +remarks: IP hijacker located somewhere in AP region, tampers with RIR data +country: AP +drop: yes + aut-num: AS140107 descr: CITIS CLOUD GROUP LIMITED remarks: part of the "Asline" IP hijacking gang, tampers with RIR data, location unknown (AP? HK? US?) @@ -201,6 +243,12 @@ remarks: ISP and IP hijacker located in HK, tampers with RIR data country: HK drop: yes +aut-num: AS141746 +descr: Orenji Server +remarks: IP hijacker located somewhere in AP area (JP?) +country: AP +drop: yes + aut-num: AS200391 descr: KREZ 999 EOOD remarks: another shady customer of "Tamatiya EOOD / 4Vendeta", located in BG, tampers with RIR data @@ -231,24 +279,30 @@ remarks: bulletproof ISP (strongly linked to AS202425) located in NL country: NL drop: yes -aut-num: AS207812 -descr: DM AUTO EOOD -remarks: another shady customer of "Tamatiya EOOD / 4Vendeta", located in BG, tampers with RIR data -country: BG -drop: yes - aut-num: AS209272 descr: Alviva Holding Limited remarks: bulletproof ISP operating from a war zone in eastern UA country: UA drop: yes +aut-num: AS210848 +descr: Telkom Internet LTD +remarks: Rogue ISP (linked to AS202425) located in NL +country: NL +drop: yes + aut-num: AS211193 descr: ABDILAZIZ UULU ZHUSUP remarks: bulletproof ISP and IP hijacker, traces to RU country: RU drop: yes +aut-num: AS212552 +descr: BitCommand LLC +remarks: Dirty ISP located somewhere in EU, cannot trust RIR data of this network +country: EU +drop: yes + aut-num: AS213058 descr: Private Internet Hosting LTD remarks: bulletproof ISP located in RU -- 2.31.1

1 0

[PATCH] override-{a1,other,xd}: Regular batch of various overrides
by Peter Müller 09 Jan '22

09 Jan '22

Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- overrides/override-a1.txt | 37 +------------- overrides/override-other.txt | 95 ++++++++++++++++++++++++++++-------- overrides/override-xd.txt | 34 ++++++++++++- 3 files changed, 108 insertions(+), 58 deletions(-) diff --git a/overrides/override-a1.txt b/overrides/override-a1.txt index 5b620fe..43e0174 100644 --- a/overrides/override-a1.txt +++ b/overrides/override-a1.txt @@ -729,21 +729,6 @@ descr: GZ Systems Limited / PureVPN remarks: VPN provider is-anonymous-proxy: yes -net: 62.73.7.0/24 -descr: Privax LTD / AVAST s.r.o. -remarks: VPN provider -is-anonymous-proxy: yes - -net: 62.73.8.0/23 -descr: Privax LTD / AVAST s.r.o. -remarks: VPN provider -is-anonymous-proxy: yes - -net: 62.73.10.0/24 -descr: Privax LTD / AVAST s.r.o. -remarks: VPN provider -is-anonymous-proxy: yes - net: 62.149.160.0/20 descr: Aruba VPN remarks: VPN provider @@ -835,7 +820,7 @@ is-anonymous-proxy: yes net: 80.254.74.0/20 descr: Monzoon / SwissVPN -remarks: VPN provider [high confidence, but not proofed] +remarks: VPN provider is-anonymous-proxy: yes net: 82.199.130.0/24 @@ -1135,11 +1120,6 @@ remarks: VPN provider [high confidence, but not proofed] is-anonymous-proxy: yes country: FR -net: 156.0.200.0/22 -descr: xTom Limited -remarks: ... network operator thinks messing with countries and having an offshore company for it is funny :-/ -is-anonymous-proxy: yes - net: 159.197.128.0/17 descr: Nationwide Computer Systems, Inc. trading as IPTrading.com remarks: Hijacked and loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… @@ -1236,16 +1216,6 @@ descr: Private Internet Access remarks: VPN provider is-anonymous-proxy: yes -net: 173.239.252.0/24 -descr: OculusProxies -remarks: VPN provider [high confidence, but not proofed] -is-anonymous-proxy: yes - -net: 173.239.252.0/24 -descr: BGRVPN -remarks: VPN provider -is-anonymous-proxy: yes - net: 173.244.32.0/19 descr: LogicWeb Inc. / BGRVPN / Private Internet Access / VPNetworks / CookieProxy / etc. pp. remarks: large IP chunk mostly used by VPN providers @@ -1505,11 +1475,6 @@ descr: GZ Systems Limited / PureVPN remarks: VPN provider is-anonymous-proxy: yes -net: 190.115.16.0/20 -descr: DDOS-GUARD CORP. -remarks: IP chunk owned by an offshore company, abuse contact is a freemail address, address says "1/2 Miles Northern Highway, Belize" -is-anonymous-proxy: yes - net: 191.96.1.0/23 descr: GZ Systems Limited / PureVPN remarks: VPN provider diff --git a/overrides/override-other.txt b/overrides/override-other.txt index 56bb12e..89ad8e0 100644 --- a/overrides/override-other.txt +++ b/overrides/override-other.txt @@ -92,8 +92,8 @@ country: GR aut-num: AS6134 descr: XNNET LLC -remarks: traces back to an unknown oversea location (HK?), seems to tamper with RIR data -country: AP +remarks: traces back to HK, seems to tamper with RIR data +country: HK aut-num: AS6412 name: Zajil International Telecom Company @@ -144,6 +144,11 @@ descr: Nexril remarks: ISP located in US, but some RIR data for announced prefixes contain garbage country: US +aut-num: AS15611 +descr: Iranian Research Organization for Science & Technology +remarks: ISP located in IR, but some RIR data for announced prefixes contain garbage +country: IR + aut-num: AS15828 descr: Blue Diamond Network Co., Ltd. remarks: Shady ISP located somewhere in AP @@ -268,6 +273,11 @@ descr: ASLINE LIMITED remarks: ... located in HK country: HK +aut-num: AS34837 +descr: Institute for Research in Fundamental Sciences +remarks: ISP located in IR, but some RIR data for announced prefixes contain garbage +country: IR + aut-num: AS34985 descr: Kirin Communication Limited remarks: ISP located in JP, but some RIR data for announced prefixes contain garbage @@ -468,6 +478,11 @@ descr: KeonWoo PARK remarks: claims US for its prefixes announced, but traces back to KR country: KR +aut-num: AS45250 +descr: Vocom International Telecommunications AP Area +remarks: ISP located in AP area, some RIR data for announced prefixes contain garbage +country: AP + aut-num: AS45671 descr: Servers Australia Pty. Ltd. remarks: ISP located in AU, but some RIR data for announced prefixes contain garbage @@ -578,11 +593,6 @@ descr: WhiteHat Inc. remarks: tampers with RIR data country: EU -aut-num: AS54600 -descr: PEG TECH INC -remarks: ISP and/or IP hijacker located in US this time, tampers with RIR data -country: US - aut-num: AS55330 descr: AFGHANTELECOM GOVERNMENT COMMUNICATION NETWORK remarks: For some reason, some "Airbus Defence and Space AS" prefixes are announced by this one... @@ -658,6 +668,21 @@ descr: INNETRA PC remarks: another shady customer of "DDoS Guard Ltd.", jurisdiction is probably RU, but traceroutes dead-end somewhere else in EU country: EU +aut-num: AS58879 +descr: Shanghai Anchang Network Security Technology Co.,Ltd. +remarks: ... network infrastructure is believed to be located in HK, has some links to ASLINE hijacking gang +country: HK + +aut-num: AS59043 +descr: Guangzhou LanDong Information technology co., LTD +remarks: ... network infrastructure is believed to be located in HK +country: HK + +aut-num: AS59117 +descr: DREAM CLOUD INNOVATION PTE. LTD. +remarks: Claims to be located in JP or SG, but is likely located in HK +country: HK + aut-num: AS59253 descr: Leaseweb Asia Pacific pte. ltd. remarks: ISP located in SG, but some RIR data for announced prefixes contain garbage @@ -773,6 +798,11 @@ descr: XIANGAO INTERNATIONAL TELECOMMUNICATION LIMITED remarks: ISP located in HK, tampers with RIR data country: HK +aut-num: AS132813 +descr: HK AISI CLOUD COMPUTING LIMITED +remarks: ISP and/or IP hijacker located in HK, tampers with RIR data +country: HK + aut-num: AS132839 descr: POWER LINE DATACENTER remarks: ISP and/or IP hijacker located in HK, tampers with RIR data @@ -799,7 +829,7 @@ remarks: IP hijacker located somewhere in AP area, suspected to be part of the " country: AP aut-num: AS134196 -descr: Cloudie Limited +descr: ANYUN INTERNET TECHNOLOGY (HK) CO.,LIMITED remarks: part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to AP region (HK? CN?) country: AP @@ -818,6 +848,11 @@ descr: Sky Digital Co., Ltd. remarks: IP hijacker located in TW, suspected to be part of the "Asline" IP hijacking gang, tampers with RIR data country: TW +aut-num: AS135097 +descr: LUOGELANG (FRANCE) LIMITED +remarks: Shady ISP located in HK, RIR data for announced prefixes contain garbage +country: HK + aut-num: AS136274 descr: Cloud Servers Pvt Ltd remarks: ISP located in NL, all RIR data for announced prefixes contain garbage @@ -828,11 +863,26 @@ descr: Optix Pakistan (Pvt.) Limited remarks: ISP located in PK, some RIR data for announced prefixes (bogons?) contain garbage country: PK +aut-num: AS136744 +descr: DREAM POWER TECHNOLOGY LIMITED +remarks: Located somewhere in AP (HK? KR?), tampers with RIR data a lot +country: AP + +aut-num: AS136746 +descr: XRCLOUD.NET INC. +remarks: ... located in HK +country: HK + aut-num: AS136933 descr: Gigabitbank Global / Anchnet Asia Limited (?) remarks: IP hijacker located somewhere in AP area, suspected to be part of the "Asline" IP hijacking gang, tampers with RIR data country: AP +aut-num: AS136950 +descr: Hong Kong FireLine Network LTD +remarks: ... located in HK (surprise!), but thinks allocating things to random countries worldwide is funny +country: HK + aut-num: AS136988 descr: Leaseweb Australia Pty. Ltd. remarks: ISP located in AU, some RIR data for announced prefixes contain garbage @@ -843,11 +893,6 @@ descr: Anchnet Asia Limited remarks: IP hijacker located in HK, tampers with RIR data country: HK -aut-num: AS137523 -descr: HONGKONG CLOUD NETWORK TECHNOLOGY CO., LIMITED -remarks: ISP and IP hijacker located in HK, tampers with RIR data -country: HK - aut-num: AS138195 descr: MOACK.Co.LTD remarks: ISP located in KR, some RIR data for announced prefixes contain garbage @@ -878,6 +923,11 @@ descr: SANREN DATA LIMITED remarks: IP hijacker located somewhere in AP region, tampers with RIR data country: AP +aut-num: AS139471 +descr: HWA CENT TELECOMMUNICATIONS LIMITED +remarks: ISP and/or IP hijacker located in AP area, tampers with RIR data +country: AP + aut-num: AS139640 descr: HK NEW CLOUD TECHNOLOGY LIMITED remarks: ISP and/or IP hijacker located in AP area, tampers with RIR data @@ -908,6 +958,11 @@ descr: Galaxy Broadband remarks: ISP located in PK, but announces 204.137.128.0/18, which is ARIN space, assigned to "AGIS" / Cogent - odd... country: PK +aut-num: AS140214 +descr: Create Prominent Information Limited +remarks: Shady ISP located in HK +country: HK + aut-num: AS140224 descr: White-Sand Cloud Computing(HK) Co., LIMITED remarks: part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to AP region @@ -938,6 +993,11 @@ descr: FLP Kochenov Aleksej Vladislavovich remarks: ISP located in UA, but RIR data for announced prefixes all say EU country: UA +aut-num: AS197540 +descr: netcup GmbH +remarks: ISP located in DE, some RIR data for announced prefixes contain garbage +country: DE + aut-num: AS200019 descr: ALEXHOST SRL remarks: ISP located in MD, majority of RIR data for announced prefixes contain garbage, we cannot trust this network @@ -1260,8 +1320,8 @@ country: ZA aut-num: AS328608 descr: Africa on Cloud -remarks: ... for some reason, I doubt a _real_ African ISP would announce solely hijacked prefixes -country: AP +remarks: ... for some reason, I doubt a _real_ African ISP would announce solely hijacked prefixes - anyway, traces back to ZA :-/ +country: ZA aut-num: AS328703 descr: Seven Network Inc. @@ -1678,11 +1738,6 @@ descr: 4b42 UG (haftungsbeschränkt) remarks: ... who thinks assigning networks to unpopulated Bouvet Island (BV) is funny :-/ country: DE -net: 2a0f:7a80::/29 -descr: ASLINE Limited -remarks: APNIC chunk owned by a HK-based company, but assigned to DE -country: AP - net: 2a0f:e400:3000::/40 descr: Kevin Buehl remarks: ... who thinks assigning networks to unpopulated Bouvet Island (BV) is funny :-/ diff --git a/overrides/override-xd.txt b/overrides/override-xd.txt index 76ceab3..738a699 100644 --- a/overrides/override-xd.txt +++ b/overrides/override-xd.txt @@ -40,8 +40,8 @@ drop: yes aut-num: AS211849 descr: Kakharov Orinbassar Maratuly -remarks: ISP and IP hijacker located in RU, many RIR data for announced prefixes contain garbage -country: RU +remarks: ISP and IP hijacker located in KZ, many RIR data for announced prefixes contain garbage +country: KZ drop: yes aut-num: AS24009 @@ -97,6 +97,12 @@ remarks: Owned by an offshore letterbox company, suspected rogue ISP country: RU drop: yes +aut-num: AS54600 +descr: PEG TECH INC +remarks: ISP and IP hijacker located in US this time, tampers with RIR data +country: US +drop: yes + aut-num: AS55303 descr: Eagle Sky Co., Lt[d ?] remarks: Autonomous System registered to offshore company, abuse contact is a freemail address, address says "0 Market Square, P.O. Box 364, Belize", seems to trace to some location in AP vicinity @@ -166,6 +172,12 @@ remarks: IP hijacker located in HK, suspected to be part of the "Asline" IP hija country: HK drop: yes +aut-num: AS137523 +descr: HONGKONG CLOUD NETWORK TECHNOLOGY CO., LIMITED +remarks: ISP and IP hijacker located in HK, tampers with RIR data +country: HK +drop: yes + aut-num: AS137951 descr: Clayer Limited remarks: part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to HK @@ -261,6 +273,18 @@ remarks: ISP located in HK, tampers with RIR data country: HK drop: yes +aut-num: AS398993 +descr: PEG TECH INC +remarks: ISP located in JP, tampers with RIR data +country: JP +drop: yes + +aut-num: AS399195 +descr: PEG TECH INC +remarks: ISP located in KR, tampers with RIR data +country: KR +drop: yes + net: 196.11.32.0/20 descr: Sanlam Life Insurance Limited remarks: Stolen AfriNIC IPv4 space announced from NL @@ -272,6 +296,12 @@ descr: NZB.si Enterprises remarks: Tampers with RIR data, not a safe place to route traffic to drop: yes +net: 2a0f:7a80::/29 +descr: ASLINE Limited +remarks: APNIC chunk owned by a HK-based IP hijacker, but assigned to DE +country: HK +drop: yes + net: 2a10:9700::/29 descr: 1337TEAM LIMITED / eliteteam[.]to remarks: Owned by an offshore letterbox company, suspected rogue ISP -- 2.26.2

1 0

[PATCH] overrides-{a1,other,xd}: Regular batch of various overrides
by Peter Müller 06 Jan '22

06 Jan '22

Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- overrides/override-a1.txt | 26 +++----- overrides/override-other.txt | 125 +++++++++++++++++------------------ overrides/override-xd.txt | 96 +++++++++++++++++++++++++-- 3 files changed, 163 insertions(+), 84 deletions(-) diff --git a/overrides/override-a1.txt b/overrides/override-a1.txt index 7365738..5b620fe 100644 --- a/overrides/override-a1.txt +++ b/overrides/override-a1.txt @@ -34,11 +34,6 @@ descr: Maginfo remarks: VPN provider is-anonymous-proxy: yes -aut-num: AS13487 -descr: ULTRA PACKET LLC -remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… -is-anonymous-proxy: yes - aut-num: AS16255 descr: IRIDIUM PROVIDER LTD remarks: VPN provider [high confidence, but not proofed] located in RU @@ -300,21 +295,11 @@ descr: Castle VPN remarks: VPN provider is-anonymous-proxy: yes -aut-num: AS397539 -descr: LAKSH CYBERSECURITY AND DEFENSE LLC -remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… -is-anonymous-proxy: yes - aut-num: AS397685 descr: Business VPN LLC remarks: VPN provider is-anonymous-proxy: yes -aut-num: AS397770 -descr: LAKSH CYBERSECURITY AND DEFENSE LLC -remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… -is-anonymous-proxy: yes - aut-num: AS397881 descr: Stingers, Inc. remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… @@ -341,6 +326,12 @@ descr: Tunbroker LLC remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… is-anonymous-proxy: yes +aut-num: AS399587 +descr: UT +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… +is-anonymous-proxy: yes +country: US + aut-num: AS399928 descr: STELLAR PROXIES remarks: VPN or open proxy provider @@ -1174,6 +1165,11 @@ descr: IPNET-VPNS remarks: VPN provider [high confidence, but not proofed] is-anonymous-proxy: yes +net: 166.137.0.0/16 +descr: Service Provider Corporation +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… +is-anonymous-proxy: yes + net: 169.239.152.0/22 descr: AfriVPN Ltd remarks: VPN provider, traces back to ZA diff --git a/overrides/override-other.txt b/overrides/override-other.txt index 8b228af..56bb12e 100644 --- a/overrides/override-other.txt +++ b/overrides/override-other.txt @@ -82,7 +82,7 @@ remarks: has no sane AS name set in APNIC DB aut-num: AS4842 descr: Tianhai InfoTech -remarks: IP hijacker located somewhere in AP, massively tampers with RIR data +remarks: IP hijacker located somewhere in AP, tampers with RIR data country: AP aut-num: AS5408 @@ -146,18 +146,18 @@ country: US aut-num: AS15828 descr: Blue Diamond Network Co., Ltd. -remarks: Hiding behind fake ISP Navitgo LLC (AS59721), tampers with RIR data -country: NL +remarks: Shady ISP located somewhere in AP +country: AP + +aut-num: AS16262 +descr: Datacheap Ltd. +remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage +country: RU aut-num: AS18185 name: Northern Taiwan Community University remarks: has no sane AS name set in APNIC DB -aut-num: AS18254 -descr: KLAYER LLC -remarks: part of the "Asline" IP hijacking gang, traces back to AP region -country: AP - aut-num: AS18530 descr: Isomedia, Inc. remarks: ISP located in US, but some RIR data for announced prefixes contain garbage @@ -178,6 +178,11 @@ descr: xTom Pty. Ltd. remarks: ISP located in AU, RIR data for announced prefixes contain garbage country: AU +aut-num: AS24413 +descr: Sunrise +remarks: ISP located in somewhere in AP +country: AP + aut-num: AS24700 descr: Yes Networks Unlimited Ltd remarks: traces to UA, but some RIR entries seem to contain garbage (VG) @@ -258,6 +263,16 @@ descr: Petersburg Internet Network Ltd. remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage country: RU +aut-num: AS34806 +descr: ASLINE LIMITED +remarks: ... located in HK +country: HK + +aut-num: AS34985 +descr: Kirin Communication Limited +remarks: ISP located in JP, but some RIR data for announced prefixes contain garbage +country: JP + aut-num: AS35042 descr: IP Interactive UG (haftungsbeschraenkt) remarks: ISP located in BG, but RIR data for announced prefixes contain garbage @@ -568,6 +583,11 @@ descr: PEG TECH INC remarks: ISP and/or IP hijacker located in US this time, tampers with RIR data country: US +aut-num: AS55330 +descr: AFGHANTELECOM GOVERNMENT COMMUNICATION NETWORK +remarks: For some reason, some "Airbus Defence and Space AS" prefixes are announced by this one... +country: AF + aut-num: AS55836 descr: Reliance Jio Infocomm Limited remarks: ISP located in IN, but some RIR data for announced prefixes contain garbage @@ -703,6 +723,11 @@ descr: 4b42 UG (haftungsbeschränkt) remarks: ... who thinks messing with countries is funny :-/ country: LI +aut-num: AS61635 +descr: GOPLEX TELECOMUNICACOES E INTERNET LTDA - ME +remarks: ... traces back to NL +country: NL + aut-num: AS61977 descr: Vivo Trade L.P. remarks: another shady customer of "DDoS Guard Ltd." @@ -738,11 +763,6 @@ descr: SWISS GLOBAL SERVICES S.A.S. remarks: ... surprisingly, all of their prefixes are hosted in CH, yet they claim CO or PA for them country: CH -aut-num: AS64437 -descr: NForce Entertainment BV -remarks: currently hijacks a single stolen /20 AfriNIC IPv4 net, hosted in NL -country: NL - aut-num: AS131685 descr: Sun Network (Hong Kong) Limited remarks: ISP and/or IP hijacker located somewhere in AP @@ -760,8 +780,8 @@ country: HK aut-num: AS133201 descr: ABCDE GROUP COMPANY LIMITED -remarks: ISP and/or IP hijacker located somewhere in AP -country: AP +remarks: ISP and/or IP hijacker located in HK +country: HK aut-num: AS133441 descr: CloudITIDC Global @@ -779,8 +799,8 @@ remarks: IP hijacker located somewhere in AP area, suspected to be part of the " country: AP aut-num: AS134196 -descr: ULan Network Limited -remarks: part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to AP region +descr: Cloudie Limited +remarks: part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to AP region (HK? CN?) country: AP aut-num: AS134351 @@ -808,16 +828,6 @@ descr: Optix Pakistan (Pvt.) Limited remarks: ISP located in PK, some RIR data for announced prefixes (bogons?) contain garbage country: PK -aut-num: AS136545 -descr: Blue Data Center -remarks: IP hijacker located somewhere in AP area, tampers with RIR data -country: AP - -aut-num: AS136800 -descr: ICIDC NETWORK -remarks: IP hijacker located somewhere in AP, suspected to be part of the "Asline" IP hijacking gang, tampers with RIR data -country: AP - aut-num: AS136933 descr: Gigabitbank Global / Anchnet Asia Limited (?) remarks: IP hijacker located somewhere in AP area, suspected to be part of the "Asline" IP hijacking gang, tampers with RIR data @@ -835,13 +845,8 @@ country: HK aut-num: AS137523 descr: HONGKONG CLOUD NETWORK TECHNOLOGY CO., LIMITED -remarks: IP hijacker located in AP area, tampers with RIR data -country: AP - -aut-num: AS137951 -descr: Clayer Limited -remarks: part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to AP region -country: AP +remarks: ISP and IP hijacker located in HK, tampers with RIR data +country: HK aut-num: AS138195 descr: MOACK.Co.LTD @@ -923,11 +928,6 @@ descr: Full Time Hosting remarks: ISP located in DE, tampers with RIR data country: DE -aut-num: AS141159 -descr: Incomparable(HK)Network Co., Limited -remarks: ISP and/or IP hijacker located in AP area, tampers with RIR data -country: AP - aut-num: AS141746 descr: Orenji Server remarks: IP hijacker located somewhere in AP area (JP?) @@ -1153,11 +1153,6 @@ descr: JMT Paso Limited remarks: ISP located in NL, but RIR data for announced prefixes contain garbage country: NL -aut-num: AS211849 -descr: Kakharov Orinbassar Maratuly -remarks: ISP and/or IP hijacker located in RU, but RIR data for announced prefixes contain garbage -country: RU - aut-num: AS211992 descr: WFD SERVICE LTD remarks: ISP located in NL, but RIR data for announced prefixes contain garbage @@ -1238,6 +1233,11 @@ descr: Udasha S.A. remarks: traceroutes dead-end somewhere near NYC, US country: US +aut-num: AS264097 +descr: WIID TelecomunicaiÂ¿Â½iÂ¿Â½es do Brasil +remarks: ... traces back to NL +country: NL + aut-num: AS267784 descr: Flyservers S.A. remarks: ISP located in NL, but RIR data for most announced prefixes contain garbage @@ -1258,11 +1258,6 @@ descr: Xhostserver LLC remarks: ISP located in ZA, many RIR data for announced prefixes contain garbage country: ZA -aut-num: AS328543 -descr: Sun Network Company Limited -remarks: IP hijacker, traces back to AP region -country: AP - aut-num: AS328608 descr: Africa on Cloud remarks: ... for some reason, I doubt a _real_ African ISP would announce solely hijacked prefixes @@ -1293,16 +1288,16 @@ descr: Leaseweb USA, Inc. remarks: ISP located in US, but some RIR data for announced prefixes contain garbage country: US +aut-num: AS397423 +descr: Tier.Net Technologies LLC +remarks: ISP located in US, but some RIR data for announced prefixes contain garbage +country: US + aut-num: AS398343 descr: Baxet Group Inc. remarks: traceroutes dead-end near Moscow, RU country: RU -aut-num: AS398478 -descr: PEG TECH INC -remarks: ISP located in HK, tampers with RIR data -country: HK - aut-num: AS398823 descr: PEG TECH INC remarks: ISP and/or IP hijacker located in HK, tampers with RIR data @@ -1320,7 +1315,7 @@ country: HK aut-num: AS399471 descr: Serverion LLC -remarks: ISP located in NL, RIR data contain garbage +remarks: ISP located in NL, some RIR data contain garbage country: NL aut-num: AS399077 @@ -1418,26 +1413,21 @@ descr: US AFG 20200130 remarks: claims to be located in US, but traces back to SK country: SK +net: 45.155.121.0/24 +descr: Itace International Limited +remarks: claims to be located in HK, but traces back to RO +country: RO + net: 47.60.0.0/14 descr: Vodafone US Inc. remarks: large Vodafone IP chunk used in ES, but assigned by ARIN (inaccurate data) country: ES -net: 80.240.96.0/24 -descr: LLC RusTel -remarks: fake location (RU), traces back to HK -country: HK - net: 85.202.80.0/24 descr: Amarutu Technology Ltd. / KoDDoS / ESecurity remarks: fake offshore location (BZ), traces back to US country: US -net: 88.151.117.0/24 -descr: Golden Internet LLC -remarks: fake location (KP), WHOIS contact points to RU -country: RU - net: 91.90.120.0/24 descr: M247 LTD, Greenland Infrastructure remarks: ... traces back to CA @@ -1588,6 +1578,11 @@ descr: NetConn Services Ltd remarks: APNIC chunk owned by a HK-based company, routed to AP region, but assigned to SC country: AP +net: 193.176.24.0/22 +descr: REACOM GmbH +remarks: The entire network is used out of RU +country: RU + net: 193.186.196.0/22 descr: QUIKA LTD remarks: claims to be located in DE, traces back to GB diff --git a/overrides/override-xd.txt b/overrides/override-xd.txt index b669621..76ceab3 100644 --- a/overrides/override-xd.txt +++ b/overrides/override-xd.txt @@ -26,16 +26,34 @@ # Please keep this file sorted. # +aut-num: AS18254 +descr: KLAYER LLC +remarks: part of the "Asline" IP hijacking gang, traces back to AP region +country: AP +drop: yes + aut-num: AS18013 descr: ASLINE LIMITED -remarks: IP hijacker, traces back to AP region -country: AP +remarks: IP hijacker, traces back to HK +country: HK +drop: yes + +aut-num: AS211849 +descr: Kakharov Orinbassar Maratuly +remarks: ISP and IP hijacker located in RU, many RIR data for announced prefixes contain garbage +country: RU +drop: yes + +aut-num: AS24009 +descr: LANLIAN INTERNATIONAL HOLDING GROUP LIMITED +remarks: IP hijacker and bulletproof ISP, possibly located near Los Angeles, US +country: US drop: yes aut-num: AS22769 descr: DDOSING NETWORK -remarks: IP hijacker located somewhere in AP, massively tampers with RIR data -country: AP +remarks: IP hijacker located in US, massively tampers with RIR data +country: US drop: yes aut-num: AS24009 @@ -119,6 +137,11 @@ descr: 1337TEAM LIMITED / eliteteam[.]to remarks: Owned by an offshore letterbox company, suspected rogue ISP drop: yes +aut-num: AS61414 +descr: EDGENAP LTD +remarks: IP hijacking? Rogue ISP? +drop: yes + aut-num: AS62068 descr: SpectraIP B.V. remarks: bulletproof ISP (linked to AS202425 et al.) located in NL @@ -131,6 +154,41 @@ remarks: bulletproof ISP (linked to AS202425 et al.) located in NL country: NL drop: yes +aut-num: AS136545 +descr: Blue Data Center +remarks: IP hijacker located somewhere in AP area, tampers with RIR data +country: AP +drop: yes + +aut-num: AS136800 +descr: ICIDC NETWORK +remarks: IP hijacker located in HK, suspected to be part of the "Asline" IP hijacking gang, tampers with RIR data +country: HK +drop: yes + +aut-num: AS137951 +descr: Clayer Limited +remarks: part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to HK +country: HK +drop: yes + +aut-num: AS138648 +descr: ASLINE Global Exchange +remarks: IP hijacker located somewhere in AP area +country: AP +drop: yes + +aut-num: AS140107 +descr: CITIS CLOUD GROUP LIMITED +remarks: part of the "Asline" IP hijacking gang, tampers with RIR data, location unknown (AP? HK? US?) +drop: yes + +aut-num: AS141159 +descr: Incomparable(HK)Network Co., Limited +remarks: ISP and IP hijacker located in HK, tampers with RIR data +country: HK +drop: yes + aut-num: AS200391 descr: KREZ 999 EOOD remarks: another shady customer of "Tamatiya EOOD / 4Vendeta", located in BG, tampers with RIR data @@ -149,6 +207,12 @@ remarks: bulletproof ISP and IP hijacker, related to AS202425 and AS62355, trace country: NL drop: yes +aut-num: AS204428 +descr: SS-Net +remarks: another shady customer of "Tamatiya EOOD / 4Vendeta", located in BG, tampers with RIR data +country: BG +drop: yes + aut-num: AS204655 descr: Novogara Ltd. remarks: bulletproof ISP (strongly linked to AS202425) located in NL @@ -167,18 +231,42 @@ remarks: bulletproof ISP operating from a war zone in eastern UA country: UA drop: yes +aut-num: AS211193 +descr: ABDILAZIZ UULU ZHUSUP +remarks: bulletproof ISP and IP hijacker, traces to RU +country: RU +drop: yes + aut-num: AS213058 descr: Private Internet Hosting LTD remarks: bulletproof ISP located in RU country: RU drop: yes +aut-num: AS328543 +descr: Sun Network Company Limited +remarks: IP hijacker, traces back to AP region +country: AP +drop: yes + aut-num: AS328671 descr: Datapacket Maroc SARL remarks: bulletproof ISP (strongly linked to AS202425) located in NL country: NL drop: yes +aut-num: AS398478 +descr: PEG TECH INC +remarks: ISP located in HK, tampers with RIR data +country: HK +drop: yes + +net: 196.11.32.0/20 +descr: Sanlam Life Insurance Limited +remarks: Stolen AfriNIC IPv4 space announced from NL +country: NL +drop: yes + net: 2a0e:b107:d10::/44 descr: NZB.si Enterprises remarks: Tampers with RIR data, not a safe place to route traffic to -- 2.26.2

1 0

[PATCH] overrides-{a1,other,xd}: Regular batch of various overrides
by Peter Müller 27 Dec '21

27 Dec '21

Swiss company Securebit AG continues to think messing with country codes is funny... :-/ Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- overrides/override-a1.txt | 5 -- overrides/override-other.txt | 140 ++++++++++++++++++++--------------- overrides/override-xd.txt | 74 +++++++++++++++--- 3 files changed, 144 insertions(+), 75 deletions(-) diff --git a/overrides/override-a1.txt b/overrides/override-a1.txt index 5fce4d9..7365738 100644 --- a/overrides/override-a1.txt +++ b/overrides/override-a1.txt @@ -285,11 +285,6 @@ remarks: VPN provider located in ES is-anonymous-proxy: yes country: ES -aut-num: AS213224 -descr: Blue Black Squared Limited -remarks: Owned by an offshore letterbox company, claims NL, but dead-ends in DE - hard to tell what is going on here -is-anonymous-proxy: yes - aut-num: AS394087 descr: Secure Internet LLC / PureVPN remarks: VPN provider diff --git a/overrides/override-other.txt b/overrides/override-other.txt index 05901f6..8b228af 100644 --- a/overrides/override-other.txt +++ b/overrides/override-other.txt @@ -149,11 +149,6 @@ descr: Blue Diamond Network Co., Ltd. remarks: Hiding behind fake ISP Navitgo LLC (AS59721), tampers with RIR data country: NL -aut-num: AS18013 -descr: ASLINE LIMITED -remarks: IP hijacker, traces back to AP region -country: AP - aut-num: AS18185 name: Northern Taiwan Community University remarks: has no sane AS name set in APNIC DB @@ -173,31 +168,16 @@ descr: EGIHosting remarks: ISP located in US, but some RIR data for announced prefixes contain garbage country: US -aut-num: AS207711 -descr: Inteldome Corporation -remarks: ... whose location we are unable to determine precisely, but its definitely not MH :-/ -country: EU - aut-num: AS21100 descr: ITL LLC remarks: ISP headquatered in BG and/or UA, physically located in NL, some RIR data for announced prefixes contain inaccurate data country: NL -aut-num: AS22769 -descr: DDOSING NETWORK -remarks: IP hijacker located somewhere in AP, massively tampers with RIR data -country: AP - aut-num: AS23858 descr: xTom Pty. Ltd. remarks: ISP located in AU, RIR data for announced prefixes contain garbage country: AU -aut-num: AS24009 -descr: HK UNITE TELECOMMUNICATIONS DEVELOPMENT LIMITED -remarks: IP hijacker (?) located in HK, tampers with RIR data -country: HK - aut-num: AS24700 descr: Yes Networks Unlimited Ltd remarks: traces to UA, but some RIR entries seem to contain garbage (VG) @@ -218,6 +198,11 @@ descr: Unicycle, LLC remarks: traces back to NL country: NL +aut-num: AS26636 +descr: GBTCloud, Inc. +remarks: ISP located in US, but some RIR data for announced prefixes contain garbage +country: US + aut-num: AS27411 descr: Leaseweb USA, Inc. remarks: ISP located in US, but some RIR data for announced prefixes contain garbage @@ -358,6 +343,11 @@ descr: Rack Sphere Hosting S.A. remarks: claims PA for some prefixes, but they are all hosted in CH country: CH +aut-num: AS40021 +descr: Contabo Inc. +remarks: ISP located in US, but some RIR data for announced prefixes contain garbage +country: US + aut-num: AS40034 descr: Confluence Networks Inc. remarks: fake offshore location (VG), traces back to Austin, TX, US @@ -373,13 +363,8 @@ descr: MLAB Open Source Community remarks: traces back to DE country: DE -aut-num: AS41466 -descr: Treidinvest LLC -remarks: another shady customer of "Tamatiya EOOD / 4Vendeta", located in BG, tampers with RIR data -country: BG - aut-num: AS41564 -descr: Packet Exchange Limited +descr: Orion Network Limited remarks: shady uplink for a bunch of dirty ISPs in SE (and likely elsewhere in EU), routing stolen AfriNIC networks, RIR data of prefixes announced by this AS cannot be trusted country: SE @@ -409,7 +394,7 @@ remarks: ISP located in GB, but some RIR data for announced prefixes contain gar country: GB aut-num: AS42960 -descr: Cloud Management LLC +descr: VH Global Limited remarks: tampers with RIR data, traces back to AP area country: AP @@ -418,11 +403,6 @@ descr: DGN TEKNOLOJI A.S. remarks: ISP located in TR, but many RIR data for announced prefixes contain garbage country: TR -aut-num: AS43092 -descr: Kirin Communication Limited -remarks: tampers with RIR data, traces back to AP area -country: AP - aut-num: AS43310 descr: TOV "LVS" remarks: ISP located in UA, but some RIR data for announced prefixes contain garbage @@ -453,11 +433,6 @@ descr: NbIServ remarks: ISP located in DE, but some RIR data for announced prefixes contain garbage country: DE -aut-num: AS44015 -descr: Landgard Management Inc. -remarks: bulletproof ISP with strong links to RU -country: RU - aut-num: AS44477 descr: IP Oleinichenko Denis remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage @@ -468,6 +443,11 @@ descr: Skylink Data Center BV remarks: ISP located in NL, but some RIR data for announced prefixes contain garbage country: NL +aut-num: AS44901 +descr: Belcloud LTD +remarks: ISP located in BG, but some RIR data for announced prefixes contain garbage +country: BG + aut-num: AS44992 descr: KeonWoo PARK remarks: claims US for its prefixes announced, but traces back to KR @@ -493,6 +473,11 @@ descr: Spectre Operations BV remarks: ISP located in NL, but some RIR data for suballocations of announced prefixes contain garbage country: NL +aut-num: AS48024 +descr: NEROCLOUD Ltd. +remarks: RIR data faked/incorrect, cannot trust this network +country: EU + aut-num: AS48158 descr: DigitalOne AG remarks: Services appear to be hosted in RU, RIR data faked/incorrect @@ -545,7 +530,7 @@ country: NL aut-num: AS50360 descr: Tamatiya EOOD / 4Vendeta -remarks: Questionable (at best) ISP located in BG, clients massively tamper with RIR data +remarks: Questionable ISP located in BG, clients massively tamper with RIR data country: BG aut-num: AS50673 @@ -553,6 +538,11 @@ descr: Serverius Holding B.V. remarks: ISP located in NL, but some RIR data for announced prefixes contain garbage country: NL +aut-num: AS51167 +descr: Contabo GmbH +remarks: ISP located in DE, but some RIR data for announced prefixes contain garbage +country: DE + aut-num: AS51089 descr: SALTYFISH TECH LTD remarks: traceroutes dead-end somewhere near HK @@ -638,11 +628,6 @@ descr: ULTRANEX LTD remarks: fake offshore location (CY), hosted in NL country: NL -aut-num: AS58271 -descr: FOP Gubina Lubov Petrivna -remarks: bulletproof ISP operating from a war zone in eastern UA -country: UA - aut-num: AS58294 descr: CloudWall Ltd. remarks: RIR data neither contain a postal address nor a phone number, traceroutes end in Sofia, BG @@ -1080,14 +1065,24 @@ country: US aut-num: AS207569 descr: Network Management Ltd. -remarks: traceroutes dead-end somewhere in or near RU -country: RU +remarks: traceroutes dead-end somewhere in or near CZ +country: CZ aut-num: AS207616 descr: Altrosky Technology Ltd. remarks: fake offshore location (SC), traces back to CZ and NL country: EU +aut-num: AS207711 +descr: Inteldome Corporation +remarks: ... whose location we are unable to determine precisely, but its definitely not MH :-/ +country: EU + +aut-num: AS207968 +descr: Internetservice Hahn +remarks: AQ != DE, you know +country: DE + aut-num: AS208046 descr: Maximilian Kutzner trading as HostSlick remarks: traces back to NL, but some RIR data for announced prefixes contain garbage @@ -1098,11 +1093,6 @@ descr: Access2.IT Group B.V. remarks: ISP located in NL, but some RIR data for announced prefixes contain garbage country: NL -aut-num: AS208410 -descr: Internet Hosting Ltd. -remarks: another shady customer of "Tamatiya EOOD / 4Vendeta", located in BG, tampers with RIR data -country: BG - aut-num: AS208485 descr: Nese Mala / Moon DC remarks: shady ISP located in TR, but many RIR data for announced prefixes contain garbage @@ -1118,11 +1108,6 @@ descr: Miti 2000 EOOD remarks: another shady customer of "Tamatiya EOOD / 4Vendeta", located in BG, tampers with RIR data country: BG -aut-num: AS209272 -descr: Alviva Holding Limited -remarks: bulletproof ISP operating from a war zone in eastern UA -country: UA - aut-num: AS209366 descr: SEMrush CY LTD remarks: claims CY for announced prefixes, but they are all hosted in NL @@ -1148,6 +1133,11 @@ descr: VPSSC Networks LTD remarks: ISP located in UA, but RIR data for announced prefixes contain garbage country: UA +aut-num: AS210654 +descr: Des Capital B.V. +remarks: Shady ISP located in NL, but RIR data for announced prefixes contain garbage +country: NL + aut-num: AS210848 descr: Telkom Internet LTD remarks: shady ISP currently located in NL @@ -1203,6 +1193,11 @@ descr: MILEGROUP LTD remarks: traceroutes dead-end somewhere in Central Europe country: EU +aut-num: AS212552 +descr: BitCommand LLC +remarks: Hides behind a CDN ISP, traceroutes dead-end somewhere in Central Europe +country: EU + aut-num: AS212667 descr: RECONN LLC remarks: ISP located in RU, but RIR data for announced prefixes contain garbage @@ -1218,11 +1213,6 @@ descr: Serverion BV remarks: ISP located in NL, but RIR data for most announced prefixes contain garbage country: NL -aut-num: AS213058 -descr: Private Internet Hosting LTD -remarks: bulletproof ISP located in RU -country: RU - aut-num: AS213194 descr: Alfa Web Solutions Ltd. remarks: shady ISP located in NL @@ -1263,6 +1253,11 @@ descr: xTom Limited remarks: ISP located in ZA, RIR data for announced prefixes contain garbage country: ZA +aut-num: AS328227 +descr: Xhostserver LLC +remarks: ISP located in ZA, many RIR data for announced prefixes contain garbage +country: ZA + aut-num: AS328543 descr: Sun Network Company Limited remarks: IP hijacker, traces back to AP region @@ -1398,6 +1393,11 @@ descr: IPv4 Superhub Limited remarks: network owned by an HK company, traces back to HK as well - but is assigned to DE. Nice try... country: HK +net: 45.129.136.0/24 +descr: Flyservers S.A. +remarks: fake offshore location (PA), traces back to NL +country: NL + net: 45.134.12.0/24 descr: MS Network LTD remarks: fake offshore location (SC), traces back to NL @@ -1493,6 +1493,21 @@ descr: PSINet, Inc. (PSI) / Cogent Communications remarks: Cogent IP range used in Europe, according to ARIN whois ("COGENT-EUROPEAN-OPERATIONS-001") country: EU +net: 141.98.82.0/24 +descr: Flyservers S.A. +remarks: fake offshore location (PA), traces back to RO +country: RO + +net: 141.98.83.0/24 +descr: Flyservers S.A. +remarks: fake offshore location (PA), traces back to RO +country: RO + +net: 146.19.102.0/24 +descr: Norbert Miczuga +remarks: ... who thinks messing with country codes is funny :-/ +country: CH + net: 149.22.96.0/19 descr: Manx Telecom Limited remarks: Suballocation of Cogent, country code missing due to ARIN DB situation (https://community.ipfire.org/t/location-database-update-error-country-code/…) @@ -1608,6 +1623,11 @@ descr: Openfactory GmbH remarks: ... who thinks assigning networks to AQ is funny :-/ country: EU +net: 2a10:ccc0::/29 +descr: Securebit AG +remarks: ... who thinks assigning networks to AQ is funny :-/ +country: CH + net: 2402:e940:f00::/48 descr: Wind Cloud Network Technology Co Ltd. remarks: appears to be used out of Tokyo, JP diff --git a/overrides/override-xd.txt b/overrides/override-xd.txt index 29057d9..b669621 100644 --- a/overrides/override-xd.txt +++ b/overrides/override-xd.txt @@ -26,11 +26,41 @@ # Please keep this file sorted. # +aut-num: AS18013 +descr: ASLINE LIMITED +remarks: IP hijacker, traces back to AP region +country: AP +drop: yes + +aut-num: AS22769 +descr: DDOSING NETWORK +remarks: IP hijacker located somewhere in AP, massively tampers with RIR data +country: AP +drop: yes + +aut-num: AS24009 +descr: LANLIAN INTERNATIONAL HOLDING GROUP LIMITED +remarks: IP hijacker located in HK, tampers with RIR data +country: HK +drop: yes + aut-num: AS39770 descr: 1337TEAM LIMITED / eliteteam[.]to remarks: Owned by an offshore letterbox company, suspected rogue ISP drop: yes +aut-num: AS43092 +descr: Kirin Communication Limited +remarks: Hijacks IP space and tampers with RIR data, traces back to JP +country: JP +drop: yes + +aut-num: AS44015 +descr: Landgard Management Inc. +remarks: bulletproof ISP with strong links to RU +country: RU +drop: yes + aut-num: AS48090 descr: PPTECHNOLOGY LIMITED remarks: bulletproof ISP (related to AS204655) located in NL @@ -72,6 +102,18 @@ remarks: bulletproof ISP (related to AS202425) located in NL country: NL drop: yes +aut-num: AS58271 +descr: FOP Gubina Lubov Petrivna +remarks: bulletproof ISP operating from a war zone in eastern UA +country: UA +drop: yes + +aut-num: AS58810 +descr: iZus Co., Ltd +remarks: Autonomous System registered to offshore company, abuse contact is a freemail address, seems to trace to some location in AP vicinity +country: AP +drop: yes + aut-num: AS60424 descr: 1337TEAM LIMITED / eliteteam[.]to remarks: Owned by an offshore letterbox company, suspected rogue ISP @@ -83,12 +125,6 @@ remarks: bulletproof ISP (linked to AS202425 et al.) located in NL country: NL drop: yes -aut-num: AS62355 -descr: Network Dedicated SAS -remarks: bulletproof ISP and IP hijacker, claims to be located in CH, but traces to NL -country: NL -drop: yes - aut-num: AS64425 descr: SKB Enterprise B.V. remarks: bulletproof ISP (linked to AS202425 et al.) located in NL @@ -113,16 +149,28 @@ remarks: bulletproof ISP and IP hijacker, related to AS202425 and AS62355, trace country: NL drop: yes +aut-num: AS204655 +descr: Novogara Ltd. +remarks: bulletproof ISP (strongly linked to AS202425) located in NL +country: NL +drop: yes + aut-num: AS207812 descr: DM AUTO EOOD remarks: another shady customer of "Tamatiya EOOD / 4Vendeta", located in BG, tampers with RIR data country: BG drop: yes -aut-num: AS204655 -descr: Novogara Ltd. -remarks: bulletproof ISP (strongly linked to AS202425) located in NL -country: NL +aut-num: AS209272 +descr: Alviva Holding Limited +remarks: bulletproof ISP operating from a war zone in eastern UA +country: UA +drop: yes + +aut-num: AS213058 +descr: Private Internet Hosting LTD +remarks: bulletproof ISP located in RU +country: RU drop: yes aut-num: AS328671 @@ -131,7 +179,13 @@ remarks: bulletproof ISP (strongly linked to AS202425) located in NL country: NL drop: yes +net: 2a0e:b107:d10::/44 +descr: NZB.si Enterprises +remarks: Tampers with RIR data, not a safe place to route traffic to +drop: yes + net: 2a10:9700::/29 descr: 1337TEAM LIMITED / eliteteam[.]to remarks: Owned by an offshore letterbox company, suspected rogue ISP +country: RU drop: yes -- 2.26.2

1 0

[PATCH] location-importer.in: Do not make things more complicated than they are
by Peter Müller 20 Dec '21

20 Dec '21

Suggested-by: Michael Tremer <michael.tremer(a)ipfire.org> Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- src/python/location-importer.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/python/location-importer.in b/src/python/location-importer.in index 118b0de..f39a42b 100644 --- a/src/python/location-importer.in +++ b/src/python/location-importer.in @@ -687,7 +687,7 @@ class CLI(object): start_address = ipaddress.ip_network(start_address, strict=False) except ValueError: start_address = start_address.split("/") - ldigits = len(start_address[0].split(".")) + ldigits = start_address[0].count(".") # How many octets do we need to add? # (LACNIC does not seem to have a /8 or greater assigned, so the following should suffice.) -- 2.26.2

2 1

[PATCH] override-other: 98.97.128.0/21 is located in CA
by Peter Müller 18 Dec '21

18 Dec '21

Fixes: #12746 Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- overrides/override-other.txt | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/overrides/override-other.txt b/overrides/override-other.txt index ca9dbad..05901f6 100644 --- a/overrides/override-other.txt +++ b/overrides/override-other.txt @@ -1478,6 +1478,11 @@ descr: QWARTA LLC remarks: fake location (US), WHOIS contact and traceroutes point to RU country: RU +net: 98.97.128.0/21 +descr: SpaceX Canada Corp. +remarks: Accurate country code missing due to ARIN DB situation, see also: #12746 +country: CA + net: 103.197.148.0/22 descr: I.C.S. Trabia-Network S.R.L. remarks: fake offshore location (HK), traces back to MD -- 2.26.2

1 0

[PATCH] Process LACNIC geofeed as well
by Peter Müller 13 Dec '21

13 Dec '21

This improves country code accurarcy for suballocations within IP space managed by LACNIC, as the delegated-extended-latest file only provides country code information at the top level of an allocated network. Sadly, lacnic.db.gz does not contain descriptions or names of Autonomous Systems within the space maintained by LACNIC. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- src/python/importer.py | 4 ++- src/python/location-importer.in | 43 +++++++++++++++++++++++++++------ 2 files changed, 39 insertions(+), 8 deletions(-) diff --git a/src/python/importer.py b/src/python/importer.py index de340b4..dee36ed 100644 --- a/src/python/importer.py +++ b/src/python/importer.py @@ -53,7 +53,9 @@ WHOIS_SOURCES = { ], # Latin America and Caribbean Network Information Centre - # XXX ??? + "LACNIC": [ + "https://ftp.lacnic.net/lacnic/dbase/lacnic.db.gz" + ], # Réseaux IP Européens "RIPE": [ diff --git a/src/python/location-importer.in b/src/python/location-importer.in index b791b4d..78bb846 100644 --- a/src/python/location-importer.in +++ b/src/python/location-importer.in @@ -681,13 +681,42 @@ class CLI(object): # Strip any excess space start_address, end_address = start_address.rstrip(), end_address.strip() - # Convert to IP address - try: - start_address = ipaddress.ip_address(start_address) - end_address = ipaddress.ip_address(end_address) - except ValueError: - log.warning("Could not parse line: %s" % line) - return + # Handle "inetnum" formatting in LACNIC DB (e.g. "24.152.8/22" instead of "24.152.8.0/22") + if start_address and not (delim or end_address): + try: + start_address = ipaddress.ip_network(start_address, strict=False) + except ValueError: + start_address = start_address.split("/") + ldigits = len(start_address[0].split(".")) + + # How many octets do we need to add? + # (LACNIC does not seem to have a /8 or greater assigned, so the following should suffice.) + if ldigits == 2: + start_address = start_address[0] + ".0.0/" + start_address[1] + elif ldigits == 3: + start_address = start_address[0] + ".0/" + start_address[1] + else: + log.warning("Could not recover IPv4 address from line in LACNIC DB format: %s" % line) + return + + try: + start_address = ipaddress.ip_network(start_address, strict=False) + except ValueError: + log.warning("Could not parse line in LACNIC DB format: %s" % line) + return + + # Enumerate first and last IP address of this network + end_address = start_address[-1] + start_address = start_address[0] + + else: + # Convert to IP address + try: + start_address = ipaddress.ip_address(start_address) + end_address = ipaddress.ip_address(end_address) + except ValueError: + log.warning("Could not parse line: %s" % line) + return inetnum["inetnum"] = list(ipaddress.summarize_address_range(start_address, end_address)) -- 2.26.2

2 1

2024

2023

2022

2021

2020

2019

2018

2017

Location