Signed-off-by: Peter Müller peter.mueller@ipfire.org --- overrides/override-a1.txt | 36 +++++++++ overrides/override-a2.txt | 10 +++ overrides/override-a3.txt | 88 +++++++++++++++++++- overrides/override-other.txt | 152 ++++++++++++++++++++++++++++++++--- 4 files changed, 274 insertions(+), 12 deletions(-)

diff --git a/overrides/override-a1.txt b/overrides/override-a1.txt index 921dd0c..3734c56 100644 --- a/overrides/override-a1.txt +++ b/overrides/override-a1.txt @@ -77,6 +77,12 @@ remarks: VPN provider [high confidence, but not proofed] located in ES is-anonymous-proxy: yes country: ES

+aut-num: AS44571 +descr: Netvillage Ltd. +remarks: VPN provider [high confidence, but not proofed] located in or near RU +is-anonymous-proxy: yes +country: RU + aut-num: AS45792 descr: Layer 3 VPN ASN remarks: VPN provider @@ -210,6 +216,11 @@ descr: BOET NOTIFY LTD. remarks: VPN provider [high confidence, but not proofed] is-anonymous-proxy: yes

+aut-num: AS212371 +descr: Evolve Proxies Ltd. +remarks: VPN provider [high confidence, but not proofed] +is-anonymous-proxy: yes + aut-num: AS212786 descr: Pooky L&W SDN BHD remarks: VPN provider [high confidence, but not proofed] @@ -441,6 +452,11 @@ descr: VPNHost SIA remarks: VPN provider is-anonymous-proxy: yes

+net: 45.14.80.0/22 +descr: ALTUS COMMUNICATIONS, INC. +remarks: VPN and/or open proxy provider [high confidence, but not proofed] +is-anonymous-proxy: yes + net: 45.41.132.0/24 descr: VPN Consumer Network remarks: VPN provider @@ -512,6 +528,16 @@ descr: Low budget VPN service remarks: VPN provider is-anonymous-proxy: yes

+net: 45.221.64.0/21 +descr: Secure Internet Limited +remarks: VPN provider +is-anonymous-proxy: yes + +net: 45.231.206.0/23 +descr: SENTRIGLOBAL LTD +remarks: VPN provider [high confidence, but not proofed] +is-anonymous-proxy: yes + net: 46.36.200.0/22 descr: IAPS Security Services, L.L.C. remarks: VPN provider @@ -698,6 +724,11 @@ descr: VPN-Services / KDDI Corporation remarks: VPN provider is-anonymous-proxy: yes

+net: 85.208.112.0/22 +descr: VPNHOST SIA +remarks: VPN provider +is-anonymous-proxy: yes + net: 88.81.248.0/24 descr: TopNet ISP VPN remarks: VPN provider @@ -954,6 +985,11 @@ descr: Cloud Innovation Ltd. remarks: hijacked AFRINIC IP chunk, owned by suspicous offshore company, scattered across dirty networks worldwide - not a safe place to go is-anonymous-proxy: yes

+net: 156.0.200.0/22 +descr: xTom Limited +remarks: ... network operator thinks messing with countries and having an offshore company for it is funny :-/ +is-anonymous-proxy: yes + net: 161.129.60.0/24 descr: 10VPN Hosting remarks: VPN provider diff --git a/overrides/override-a2.txt b/overrides/override-a2.txt index b8b3b08..24db2a8 100644 --- a/overrides/override-a2.txt +++ b/overrides/override-a2.txt @@ -197,6 +197,11 @@ descr: Shaw Satellite Services, Inc. remarks: Satellite Internet provider [high confidence, but not proofed] is-satellite-provider: yes

+aut-num: AS32806 +descr: Emerging Markets Communications +remarks: Satellite Internet provider +is-satellite-provider: yes + aut-num: AS35410 descr: LVS Transnational Corporation (tm) OOO Nord-telecom remarks: Satellite Internet provider [high confidence, but not proofed] @@ -293,6 +298,11 @@ remarks: Chinese satellite Internet provider [high confidence, but not proofe is-satellite-provider: yes country: AP

+aut-num: AS42705 +descr: Talia +remarks: Satellite Internet provider +is-satellite-provider: yes + aut-num: AS42726 descr: BusinessCom CZ spol. s r.o. remarks: Satellite Internet provider diff --git a/overrides/override-a3.txt b/overrides/override-a3.txt index daacc95..9200b78 100644 --- a/overrides/override-a3.txt +++ b/overrides/override-a3.txt @@ -25,6 +25,11 @@ descr: DirectNIC, Ltd. remarks: Generic anycast network [high confidence, but not proofed] is-anycast: yes

+aut-num: AS13335 +descr: Cloudflare, Inc. +remarks: Worldwide CDN, does not make sense to assign their networks to a specific country +is-anycast: yes + aut-num: AS16625 descr: Akamai Technologies, Inc. remarks: Worldwide CDN, does not make sense to assign their networks to a specific country @@ -37,14 +42,29 @@ is-anycast: yes

aut-num: AS20940 descr: Akamai International BV -remarks: Worldwide CDN, does not make sense to assign their networks to a specific country +remarks: Worldwide CDN, does not make sense to assign their networks to a specific country is-anycast: yes

+aut-num: AS21342 +descr: Akamai International BV +remarks: Worldwide CDN, does not make sense to assign their networks to a specific country +is-anycast: yes + +aut-num: AS24319 +descr: Akamai International BV +remarks: Worldwide CDN, does not make sense to assign their networks to a specific country +is-anycast: yesx + aut-num: AS28064 descr: Smart Data Center S.A. remarks: Generic anycast network [high confidence, but not proofed] is-anycast: yes

+aut-num: AS29997 +descr: Vitalwerks Internet Solutions, LLC +remarks: Public anycast DNS resolver network [high confidence, but not proofed] +is-anycast: yes + aut-num: AS31529 descr: DENIC eG remarks: TLD operator's anycast network @@ -55,6 +75,11 @@ descr: Citigroup remarks: Public anycast DNS resolver network [high confidence, but not proofed] is-anycast: yes

+aut-num: AS34164 +descr: Akamai International BV +remarks: Worldwide CDN, does not make sense to assign their networks to a specific country +is-anycast: yes + aut-num: AS34738 descr: WEBHOST LIMITED remarks: Generic anycast network [high confidence, but not proofed] @@ -80,6 +105,12 @@ descr: ANEXIA Internetdienstleistungs GmbH remarks: Public anycast DNS nameserver network [high confidence, but not proofed] is-anycast: yes

+aut-num: AS49287 +descr: Melbikomas UAB +remarks: Generic anycast network [high confidence, but not proofed] +is-anycast: yes +country: EU + aut-num: AS48550 descr: Pascal Mathis trading as SnapServ Mathis remarks: Generic anycast network @@ -215,6 +246,11 @@ descr: Cloudflare, Inc. remarks: Public anycast DNS resolver is-anycast: yes

+net: 2.16.0.0/13 +descr: Akamai International B.V. +remarks: IP chunk in use for providing CDN services worldwide, subnets scatter across various Autonomous Systems +is-anycast: yes + net: 2.58.58.0/24 descr: Hybula B.V. remarks: Generic anycast network @@ -250,6 +286,21 @@ descr: Quad9 remarks: Public anycast DNS resolver is-anycast: yes

+net: 23.32.0.0/11 +descr: Akamai International B.V. +remarks: IP chunk in use for providing CDN services worldwide, subnets scatter across various Autonomous Systems +is-anycast: yes + +net: 23.72.0.0/13 +descr: Akamai International B.V. +remarks: IP chunk in use for providing CDN services worldwide, subnets scatter across various Autonomous Systems +is-anycast: yes + +net: 23.192.0.0/11 +descr: Akamai International B.V. +remarks: IP chunk in use for providing CDN services worldwide, subnets scatter across various Autonomous Systems +is-anycast: yes + net: 37.72.151.0/24 descr: LWLcom GmbH remarks: Generic anycast network @@ -575,6 +626,11 @@ descr: Thomas Steen Rasmussen / UncensoredDNS / censurfridns.dk remarks: Public anycast DNS resolver is-anycast: yes

+net: 92.122.0.0/15 +descr: Akamai International B.V. +remarks: IP chunk in use for providing CDN services worldwide, subnets scatter across various Autonomous Systems +is-anycast: yes + net: 92.118.229.0/24 descr: Epik remarks: Generic anycast network @@ -650,6 +706,11 @@ descr: Vision247 remarks: Generic anycast network is-anycast: yes

+net: 95.100.0.0/15 +descr: Akamai International B.V. +remarks: IP chunk in use for providing CDN services worldwide, subnets scatter across various Autonomous Systems +is-anycast: yes + net: 95.177.2.0/24 descr: Griffin Internet Infrastructure Anycast remarks: Generic anycast network @@ -660,6 +721,11 @@ descr: VikingHost remarks: Generic anycast network is-anycast: yes

+net: 104.64.0.0/10 +descr: Akamai International B.V. +remarks: IP chunk in use for providing CDN services worldwide, subnets scatter across various Autonomous Systems +is-anycast: yes + net: 109.72.143.0/24 descr: GPC Services AG remarks: Generic anycast network @@ -1462,6 +1528,11 @@ descr: SafeDNS, Inc. remarks: Generic anycast network is-anycast: yes

+net: 195.47.253.0/24 +descr: LLC "Hostmaster" +remarks: TLD operator's anycast network +is-anycast: yes + net: 195.80.153.0/24 descr: SAFECLOUDBOX remarks: Generic anycast network @@ -1587,6 +1658,11 @@ descr: Thomas Steen Rasmussen / UncensoredDNS / censurfridns.dk remarks: Public anycast DNS resolver is-anycast: yes

+net: 2001:678:a80::/48 +descr: Informatics Solutions Limited +remarks: Generic anycast network +is-anycast: yes + net: 2606:4700:4700::/48 descr: Cloudflare, Inc. remarks: Public anycast DNS resolver @@ -1612,6 +1688,11 @@ descr: Thomas Harwood remarks: Public anycast DNS resolver is-anycast: yes

+net: 2a06:e881:4300::/44 +descr: RISHIKESHAN LAVAKUMAR +remarks: Generic anycast network +is-anycast: yes + net: 2a07:59c6:d006::/48 descr: NetShelter remarks: Generic anycast network @@ -1627,6 +1708,11 @@ descr: Zeimudo Networks remarks: Generic anycast network is-anycast: yes

+net: 2a0b:6b83::/48 +descr: Roelf Wichertjes +remarks: Generic anycast network +is-anycast: yes + net: 2a0c:3800:ff::/48 descr: Jean-Remy Buchs remarks: Generic anycast network diff --git a/overrides/override-other.txt b/overrides/override-other.txt index e387dbd..ce5bdb5 100644 --- a/overrides/override-other.txt +++ b/overrides/override-other.txt @@ -23,10 +23,15 @@ descr: PJSC "Vimpelcom" remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage country: RU

+aut-num: AS3741 +descr: Dimension Data +remarks: ISP (?) located in ZA, but some RIR data for announced prefixes contain garbage +country: ZA + aut-num: AS6134 descr: XNNET LLC remarks: traces back to an unknown oversea location (HK?), seems to tamper with RIR data -country: HK +country: AP

aut-num: AS7203 descr: Leaseweb USA, Inc. @@ -53,6 +58,11 @@ descr: KLAYER LLC remarks: part of the "Asline" IP hijacking gang, traces back to AP region country: AP

+aut-num: AS21100 +descr: ITL LLC +remarks: ISP headquatered in BG and/or UA, physically located in NL, some RIR data for announced prefixes contain inaccurate data +country: NL + aut-num: AS22769 descr: DDOSING NETWORK remarks: IP hijacker located somewhere in AP, massively tampers with RIR data @@ -78,6 +88,11 @@ descr: Netcalibre Ltd. remarks: ISP located in GB, but some RIR data for announced prefixes contain garbage country: GB

+aut-num: AS26021 +descr: Unicycle, LLC +remarks: traces back to NL +country: NL + aut-num: AS27411 descr: Leaseweb USA, Inc. remarks: ISP located in US, but some RIR data for announced prefixes contain garbage @@ -128,6 +143,11 @@ descr: Neterra Ltd. remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage country: RU

+aut-num: AS39182 +descr: Netex Limited +remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage +country: RU + aut-num: AS39287 descr: ab stract / Peter Kolmisoppi remarks: tampers with RIR data, traces back to SE @@ -138,6 +158,11 @@ descr: Confluence Networks Inc. remarks: fake offshore location (VG), traces back to Austin, TX, US country: US

+aut-num: AS40065 +descr: CNSERVERS LLC +remarks: Shady ISP located in US, tampers with RIR data +country: US + aut-num: AS41466 descr: Treidinvest LLC remarks: another shady customer of "Tamatiya EOOD / 4Vendeta", located in BG, tampers with RIR data @@ -146,7 +171,12 @@ country: BG aut-num: AS41564 descr: Packet Exchange Limited remarks: shady uplink for a bunch of dirty ISPs in SE (and likely elsewhere in EU), routing stolen AfriNIC networks, RIR data of prefixes announced by this AS cannot be trusted -country: EU +country: SE + +aut-num: AS41608 +descr: NextGenWebs, S.L. +remarks: traces back to NL +country: NL

aut-num: AS42397 descr: Bunea TELECOM SRL @@ -165,14 +195,29 @@ country: GB

aut-num: AS42960 descr: Cloud Management LLC -remarks: tampers with RIR data, traces back to HK -country: HK +remarks: tampers with RIR data, traces back to AP area +country: AP + +aut-num: AS43260 +descr: DGN TEKNOLOJI A.S. +remarks: ISP located in TR, but many RIR data for announced prefixes contain garbage +country: TR

aut-num: AS43310 descr: TOV "LVS" remarks: ISP located in UA, but some RIR data for announced prefixes contain garbage country: UA

+aut-num: AS43350 +descr: NForce Entertainment B.V. +remarks: ISP located in NL, but some RIR data for announced prefixes contain garbage +country: NL + +aut-num: AS43624 +descr: PQ HOSTING S.R.L. +remarks: tampers with RIR data sometimes, traces back to NL +country: NL + aut-num: AS44015 descr: Landgard Management Inc. remarks: bulletproof ISP with strong links to RU @@ -188,16 +233,16 @@ descr: PPTECHNOLOGY LIMITED remarks: bulletproof ISP (related to AS204655) located in NL country: NL

-aut-num: AS41564 -descr: Global Colocation Limited -remarks: part of a dirty ISP conglomerate most likely operating out of SE -country: SE - aut-num: AS48721 descr: ADM Service Ltd. remarks: traces back to Vilnius, LT country: LT

+aut-num: AS49392 +descr: LLC Baxet +remarks: tampers with RIR data, traces back to RU +country: RU + aut-num: AS49466 descr: KLAYER LLC remarks: part of the "Asline" IP hijacking gang, traces back to AP region @@ -218,11 +263,21 @@ descr: Tamatiya EOOD / 4Vendeta remarks: Questionable (at best) ISP located in BG, clients massively tamper with RIR data country: BG

+aut-num: AS50673 +descr: Serverius Holding B.V. +remarks: ISP located in NL, but some RIR data for announced prefixes contain garbage +country: NL + aut-num: AS51558 descr: Smart Telecom S.A.R.L remarks: tampers with RIR data, traces back to RU country: RU

+aut-num: AS51659 +descr: LLC Baxet +remarks: tampers with RIR data, traces back to RU +country: RU + aut-num: AS55933 descr: Cloudie Limited remarks: part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to AP region @@ -238,6 +293,11 @@ descr: PE Skurykhin Mukola Volodumurovuch remarks: tampers with RIR data, traces back to UA country: UA

+aut-num: AS57043 +descr: Hostkey B.V. +remarks: ISP located in NL, but some RIR data for announced prefixes contain garbage +country: NL + aut-num: AS57717 descr: FiberXpress BV remarks: bulletproof ISP (related to AS202425) located in NL @@ -248,11 +308,26 @@ descr: DDOS-GUARD LTD remarks: shady ISP, customers massively tamper with RIR data, we cannot trust this network country: RU

+aut-num: AS57756 +descr: Telefonica LLC +remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage +country: RU + aut-num: AS57858 descr: Inter Connects Inc. remarks: part of a dirty ISP conglomerate operating most likely out of SE, hijacking stolen AfriNIC networks, massively tampers with RIR data country: SE

+aut-num: AS57972 +descr: Inter Connects Inc. +remarks: part of a dirty ISP conglomerate operating most likely out of SE, hijacking stolen AfriNIC networks, massively tampers with RIR data +country: SE + +aut-num: AS58061 +descr: Scalaxy B.V. +remarks: ISP located in NL, but some RIR data for announced prefixes contain garbage +country: NL + aut-num: AS58073 descr: YISP BV remarks: ISP located in NL, but some RIR data for announced prefixes contain garbage @@ -278,6 +353,11 @@ descr: Batterflyai Media Ltd. remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage country: RU

+aut-num: AS60404 +descr: The Infrastructure Group B.V. +remarks: ISP located in NL, but some RIR data for announced prefixes contain garbage +country: NL + aut-num: AS60412 descr: DignusData LLC remarks: ISP located in PL, but _all_ RIR data for announced prefixes contain garbage @@ -313,6 +393,11 @@ descr: VpsQuan L.L.C. remarks: claims to be located in US, but traces to HK country: HK

+aut-num: AS62900 +descr: ColoMX LLC +remarks: ISP located in US, but many RIR data for announced prefixes contain garbage +country: US + aut-num: AS63119 descr: Inter Connects Inc. remarks: part of a dirty ISP conglomerate, traces back to US this time @@ -338,6 +423,11 @@ descr: Leaseweb Asia Pacific pte. ltd. remarks: ISP located in HK, some RIR data for announced prefixes contain garbage country: HK

+aut-num: AS134196 +descr: ULan Network Limited +remarks: part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to AP region +country: AP + aut-num: AS134351 descr: Leaseweb Japan K.K. remarks: ISP located in JP, some RIR data for announced prefixes contain garbage @@ -383,6 +473,11 @@ descr: ANLIAN NETWORK TECHNOLOGY CO., LIMITED remarks: ISP located in HK, tampers with RIR data country: HK

+aut-num: AS139879 +descr: Galaxy Broadband +remarks: ISP located in PK, but announces 204.137.128.0/18, which is ARIN space, assigned to "AGIS" / Cogent - odd... +country: PK + aut-num: AS140733 descr: Wujidun Network Limited remarks: part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to AP region @@ -440,8 +535,8 @@ country: NL

aut-num: AS202492 descr: SILVERHILL GROUP HOLDING LTD / SAKIS POLUNIGIS -remarks: fake offshore location (SC), traces back to NL -country: NL +remarks: fake offshore location (SC), traces back to RU +country: RU

aut-num: AS202769 descr: Cooperative Investments LLC @@ -458,6 +553,11 @@ descr: Kevin Holly trading as Silent Ghost e.U. remarks: AS run by someone who thinks allocating IP networks to AQ is funny (it is not, kid) :-/ country: NL

+aut-num: AS204307 +descr: Rishikeshan Lavakumar +remarks: Network operator thinks messing with RIR data is funny... :-/ +country: EU + aut-num: AS204353 descr: Global Offshore Limited remarks: part of a dirty ISP conglomerate with links to SE, RIR data of prefixes announced by this AS cannot be trusted @@ -513,6 +613,11 @@ descr: Maximilian Kutzner trading as HostSlick remarks: traces back to NL, but some RIR data for announced prefixes contain garbage country: NL

+aut-num: AS208258 +descr: Access2.IT Group B.V. +remarks: ISP located in NL, but some RIR data for announced prefixes contain garbage +country: NL + aut-num: AS208410 descr: Internet Hosting Ltd. remarks: another shady customer of "Tamatiya EOOD / 4Vendeta", located in BG, tampers with RIR data @@ -553,6 +658,11 @@ descr: Harry Dowd remarks: ISP located in GB, but RIR data for announced prefixes contain garbage country: GB

+aut-num: AS212477 +descr: RoyaleHosting B.V. +remarks: ISP located in NL, but RIR data for announced prefixes contain garbage +country: NL + aut-num: AS212962 descr: Quality Area Ltd. remarks: traceroutes dead-end somewhere near Crimera, UA @@ -798,6 +908,11 @@ descr: NetConn Services Ltd remarks: APNIC chunk owned by a HK-based company, routed to AP region, but assigned to SC country: AP

+net: 193.186.196.0/22 +descr: QUIKA LTD +remarks: claims to be located in DE, traces back to GB +country: GB + net: 195.66.165.0/24 descr: Posta Crne Gore remarks: Orphaned RIR data, see: https://lists.ipfire.org/pipermail/location/2021-April/000267.html @@ -848,7 +963,22 @@ descr: Datashield, Inc. remarks: fake offshore location (SC), traces back to NL country: NL

+net: 2a09:4c0:3000::/40 +descr: Securebit AG +remarks: ... who thinks assigning networks to unpopulated Bouvet Island (BV) is funny :-/ +country: CH + +net: 2a0e:b101:3000::/40 +descr: 4b42 UG (haftungsbeschränkt) +remarks: ... who thinks assigning networks to unpopulated Bouvet Island (BV) is funny :-/ +country: DE + net: 2a0f:7a80::/29 descr: ASLINE Limited remarks: APNIC chunk owned by a HK-based company, but assigned to DE country: AP + +net: 2a0f:e400:3000::/40 +descr: Kevin Buehl +remarks: ... who thinks assigning networks to unpopulated Bouvet Island (BV) is funny :-/ +country: CH