Signed-off-by: Peter Müller peter.mueller@ipfire.org --- overrides/override-a1.txt | 177 ++++++++++++++++++++++++++++++++++- overrides/override-other.txt | 20 ++++ 2 files changed, 195 insertions(+), 2 deletions(-)
diff --git a/overrides/override-a1.txt b/overrides/override-a1.txt index b4940b2..acb5cb2 100644 --- a/overrides/override-a1.txt +++ b/overrides/override-a1.txt @@ -34,6 +34,11 @@ descr: Maginfo remarks: VPN provider is-anonymous-proxy: yes
+aut-num: AS13487 +descr: ULTRA PACKET LLC +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-netw... +is-anonymous-proxy: yes + aut-num: AS16255 descr: IRIDIUM PROVIDER LTD remarks: VPN provider [high confidence, but not proofed] located in RU @@ -99,6 +104,11 @@ descr: Layer 3 VPN ASN remarks: VPN provider is-anonymous-proxy: yes
+aut-num: AS46732 +descr: RESIDENTIAL NETWORKING SOLUTIONS LLC +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-netw... +is-anonymous-proxy: yes + aut-num: AS51432 descr: BeeVPN ApS remarks: VPN provider @@ -184,6 +194,11 @@ descr: AMPR VPN remarks: VPN provider is-anonymous-proxy: yes
+aut-num: AS197640 +descr: OverPlay.Net LP +remarks: VPN and/or proxy provider +is-anonymous-proxy: yes + aut-num: AS201665 descr: Anonymizer, Inc. remarks: VPN provider @@ -206,6 +221,22 @@ remarks: VPN provider located in BR [high confidence, but not proofed] is-anonymous-proxy: yes country: BR
+aut-num: AS207907 +descr: NSQ Venture (M) SDN BHD +remarks: Possibly part of https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-netw..., also tampers with RIR data +is-anonymous-proxy: yes +country: US + +aut-num: AS207976 +descr: V6 Networking LLC +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-netw... +is-anonymous-proxy: yes + +aut-num: AS208256 +descr: Stingers, Inc. +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-netw... +is-anonymous-proxy: yes + aut-num: AS208294 descr: CIA TRIAD SECURITY LLC remarks: Tor relay provider located in or near Berlin, DE @@ -229,6 +260,11 @@ remarks: (Rogue) VPN provider is-anonymous-proxy: yes country: EU
+aut-num: AS208979 +descr: RESNET INC +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-netw... +is-anonymous-proxy: yes + aut-num: AS209623 descr: David Craig remarks: (Rogue) VPN provider @@ -297,16 +333,47 @@ descr: Castle VPN remarks: VPN provider is-anonymous-proxy: yes
+aut-num: AS397539 +descr: LAKSH CYBERSECURITY AND DEFENSE LLC +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-netw... +is-anonymous-proxy: yes + aut-num: AS397685 descr: Business VPN LLC remarks: VPN provider is-anonymous-proxy: yes
+aut-num: AS397770 +descr: LAKSH CYBERSECURITY AND DEFENSE LLC +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-netw... +is-anonymous-proxy: yes + +aut-num: AS397881 +descr: Stingers, Inc. +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-netw... +is-anonymous-proxy: yes + +aut-num: AS398083 +descr: Ting Wireless +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-netw... +is-anonymous-proxy: yes +country: US + aut-num: AS398271 descr: HardenedVPN[.]com LLC remarks: VPN provider is-anonymous-proxy: yes
+aut-num: AS398481 +descr: RedMercury Ltd. +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-netw... +is-anonymous-proxy: yes + +aut-num: AS398559 +descr: Tunbroker LLC +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-netw... +is-anonymous-proxy: yes + aut-num: AS399928 descr: STELLAR PROXIES remarks: VPN or open proxy provider @@ -317,6 +384,11 @@ descr: VPN Consumer Network remarks: VPN provider is-anonymous-proxy: yes
+net: 2.59.248.0/22 +descr: Mayak Creative Ltd. +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-netw... +is-anonymous-proxy: yes + net: 5.62.16.0/24 descr: Privax LTD / PRCDN Consumer Pool / AVAST s.r.o. remarks: VPN provider @@ -367,6 +439,11 @@ descr: Privax LTD / PRCDN Consumer Pool / AVAST s.r.o. remarks: VPN provider is-anonymous-proxy: yes
+net: 5.181.40.0/22 +descr: Tal Mukdasi +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-netw... +is-anonymous-proxy: yes + net: 5.182.34.0/24 descr: Coca Proxies VOF remarks: VPN provider @@ -382,6 +459,11 @@ descr: VPNTunnel remarks: VPN provider is-anonymous-proxy: yes
+net: 5.253.56.0/22 +descr: Mayak Consulting Ltd. +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-netw... +is-anonymous-proxy: yes + net: 5.254.128.0/19 descr: VPNTunnel / Hushy VPN / Anonine VPN / Edelino Commerce Inc. remarks: VPN provider @@ -497,6 +579,12 @@ descr: GZ Systems Limited / PureVPN remarks: VPN provider is-anonymous-proxy: yes
+net: 45.8.92.0/22 +descr: Cloud Computing Ltd. +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-netw... +is-anonymous-proxy: yes +country: US + net: 45.9.12.0/22 descr: VPNHost SIA remarks: VPN provider @@ -552,6 +640,16 @@ descr: Secure Internet LLC remarks: VPN provider is-anonymous-proxy: yes
+net: 45.131.168.0/22 +descr: Xantho Ltd. +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-netw... +is-anonymous-proxy: yes + +net: 45.135.160.0/22 +descr: Revonia Ltd. / LAKSH / IAPS +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-netw... +is-anonymous-proxy: yes + net: 45.142.122.0/24 descr: Shtrauh Andrey remarks: VPN provider [high confidence, but not proofed] @@ -573,6 +671,16 @@ descr: Express VPN International Ltd remarks: VPN provider is-anonymous-proxy: yes
+net: 45.155.128.0/22 +descr: Revonia Ltd. / LAKSH / IAPS +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-netw... +is-anonymous-proxy: yes + +net: 45.157.36.0/22 +descr: Gabor Marton +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-netw... +is-anonymous-proxy: yes + net: 45.220.72.0/22 descr: Low budget VPN service remarks: VPN provider @@ -590,7 +698,7 @@ is-anonymous-proxy: yes
net: 46.36.200.0/22 descr: IAPS Security Services, L.L.C. -remarks: VPN provider +remarks: VPN provider, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-netw... is-anonymous-proxy: yes
net: 46.243.136.0/21 @@ -808,6 +916,11 @@ descr: VPNHOST SIA remarks: VPN provider is-anonymous-proxy: yes
+net: 85.209.132.0/22 +descr: Mayak Creative Ltd. +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-netw... +is-anonymous-proxy: yes + net: 88.81.248.0/24 descr: TopNet ISP VPN remarks: VPN provider @@ -868,6 +981,11 @@ descr: Octopusnet VPN remarks: VPN provider is-anonymous-proxy: yes
+net: 95.214.160.0/22 +descr: B Consulting Ltd. +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-netw... +is-anonymous-proxy: yes + net: 98.159.233.0/24 descr: VPN Consumer Network remarks: VPN provider @@ -1064,6 +1182,11 @@ descr: xTom Limited remarks: ... network operator thinks messing with countries and having an offshore company for it is funny :-/ is-anonymous-proxy: yes
+net: 159.197.128.0/17 +descr: Nationwide Computer Systems, Inc. trading as IPTrading.com +remarks: Hijacked and loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-netw... +is-anonymous-proxy: yes + net: 161.129.60.0/24 descr: 10VPN Hosting remarks: VPN provider @@ -1235,6 +1358,16 @@ descr: Freedom of Speech VPN / nVPN / David Craig remarks: (Rogue) VPN provider is-anonymous-proxy: yes
+net: 185.147.100.0/22 +remarks: Mayak Smart Services Ltd. +descr: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-netw... +is-anonymous-proxy: yes + +net: 185.147.213.0/24 +descr: Strong Technology SE +remarks: VPN provider +is-anonymous-proxy: yes + net: 185.153.177.0/24 descr: NordVPN remarks: VPN provider @@ -1313,6 +1446,11 @@ descr: VKVPN remarks: VPN provider is-anonymous-proxy: yes
+net: 185.239.244.0/22 +descr: Xantho Ltd. +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-netw... +is-anonymous-proxy: yes + net: 185.244.28.0/22 descr: Angelo Kreikamp trading as Forhosting / Freedom of Speech VPN / nVPN / David Craig / ... remarks: (Rogue) VPN provider @@ -1324,6 +1462,21 @@ remarks: (Rogue) VPN provider, fake location (SC), traces back to NL is-anonymous-proxy: yes country: NL
+net: 185.244.104.0/22 +descr: Xantho Ltd. +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-netw... +is-anonymous-proxy: yes + +net: 185.246.236.0/22 +descr: Xantho Ltd. +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-netw... +is-anonymous-proxy: yes + +net: 185.254.16.0/22 +descr: Xantho Ltd. +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-netw... +is-anonymous-proxy: yes + net: 186.2.160.0/20 descr: DDOS-GUARD CORP. remarks: IP chunk owned by an offshore company, abuse contact is a freemail address, address says "1/2 Miles Northern Highway, Belize" @@ -1489,6 +1642,16 @@ descr: NordVPN remarks: VPN provider is-anonymous-proxy: yes
+net: 194.38.40.0/22 +descr: BIDIT Ltd. +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-netw... +is-anonymous-proxy: yes + +net: 194.48.100.0/22 +descr: B Consulting Ltd. +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-netw... +is-anonymous-proxy: yes + net: 194.87.207.0/24 descr: Lynx Proxies Ltd. remarks: VPN provider @@ -1521,7 +1684,7 @@ is-anonymous-proxy: yes
net: 196.52.0.0/14 descr: LogicWeb Inc. / BGRVPN / Private Internet Access / VPNetworks / CookieProxy / etc. pp. -remarks: large IP chunk mostly used by VPN providers +remarks: Hijacked AfriNIC IP chunk mostly used by VPN providers is-anonymous-proxy: yes
net: 196.61.192.0/20 @@ -1539,6 +1702,11 @@ descr: Defender cloud international LLC remarks: VPN provider [high confidence, but not proofed] is-anonymous-proxy: yes
+net: 198.228.0.0/16 +descr: Service Provider Corporation +remarks: Hijacked and loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-netw... +is-anonymous-proxy: yes + net: 199.249.223.0/24 descr: Quintex Alliance Consulting remarks: Tor relay provider @@ -1754,6 +1922,11 @@ descr: CACHE-VPN-NET remarks: VPN provider [high confidence, but not proofed] is-anonymous-proxy: yes
+net: 2a03:b600::/29 +descr: IAPS Security Services, L.L.C. +remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-netw... +is-anonymous-proxy: yes + net: 2a03:e600:100::/48 descr: Foundation for Applied Privacy remarks: Tor relay provider diff --git a/overrides/override-other.txt b/overrides/override-other.txt index 2c7caaa..e99325b 100644 --- a/overrides/override-other.txt +++ b/overrides/override-other.txt @@ -354,6 +354,11 @@ descr: NextGenWebs, S.L. remarks: traces back to NL country: NL
+aut-num: AS42237 +descr: AMATI FOUNDATION +remarks: ISP located in SE, seems to tamper with RIR data (proxies too?) +country: SE + aut-num: AS42397 descr: Bunea TELECOM SRL remarks: ISP located in RO, but some RIR data for announced prefixes contain garbage @@ -989,6 +994,11 @@ descr: AAEX NETWORK TECHNOLOGY LTD remarks: IP hijacker located in HK country: HK
+aut-num: AS207429 +descr: Kapteyan Bilisim Teknolojileri +remarks: ISP located in TR, but many RIR data for announced prefixes contain garbage +country: TR + aut-num: AS207461 descr: Liquid IO remarks: ISP located in US, but many RIR data for announced prefixes contain garbage @@ -1024,6 +1034,11 @@ descr: Internet Hosting Ltd. remarks: another shady customer of "Tamatiya EOOD / 4Vendeta", located in BG, tampers with RIR data country: BG
+aut-num: AS208485 +descr: Nese Mala / Moon DC +remarks: shady ISP located in TR, but many RIR data for announced prefixes contain garbage +country: TR + aut-num: AS209132 descr: Alviva Holding Limited remarks: ISP located in BG, but RIR data for announced prefixes contain garbage @@ -1044,6 +1059,11 @@ descr: SEMrush CY LTD remarks: claims CY for announced prefixes, but they are all hosted in NL country: NL
+aut-num: AS209371 +descr: Cenk Aksit +remarks: shady ISP located in TR, but RIR data for announced prefixes contain garbage +country: TR + aut-num: AS209401 descr: Gudaev Maxim Amrakhovich remarks: announcements scatter across various places in EU (DE/CZ/??), but RIR data contain garbage
-
Peter Müller