From mboxrd@z Thu Jan  1 00:00:00 1970
From: Peter =?utf-8?q?M=C3=BCller?= <peter.mueller@link38.eu>
To: location@lists.ipfire.org
Subject: Re: [PATCH v2] add networks with faked KP location
Date: Mon, 10 Sep 2018 17:51:06 +0200
Message-ID: <ca97ef34-ae75-5f67-1a50-836192c36d2c@link38.eu>
In-Reply-To: <422ae16f-379b-7860-f9e2-3a9e79e837fa@link38.eu>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============9076506988286578501=="
List-Id: <location.lists.ipfire.org>

--===============9076506988286578501==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

- ping -

> These networks claim to be located in North Korea, but are mostly used
> for VPN or other anonymisation purposes. Therefore they are added to
> A1 or "others" override files.
>=20
> See https://blog.trendmicro.com/trendlabs-security-intelligence/a-closer-lo=
ok-at-north-koreas-internet/
> for details. 57.73.224.0/19 was reassigned since then and contains
> valid data now, causing it to be omitted.
>=20
> The second version of this patch superseds the first
> one which was broken due to bugs in the MUAs GPG implementation.
>=20
> Fixes #11757.
>=20
> Signed-off-by: Peter M=C3=BCller <peter.mueller(a)link38.eu>
> ---
>  country-overrides/override-a1.txt    | 25 +++++++++++++++++++++++++
>  country-overrides/override-other.txt |  5 +++++
>  2 files changed, 30 insertions(+)
>=20
> diff --git a/country-overrides/override-a1.txt b/country-overrides/override=
-a1.txt
> index bae4ee9..0e94eee 100644
> --- a/country-overrides/override-a1.txt
> +++ b/country-overrides/override-a1.txt
> @@ -116,6 +116,16 @@ descr:		Privax LTD
>  remarks:	VPN provider
>  newcountry:	A1
> =20
> +net:		5.62.56.160/30
> +descr:		Privax LTD/AVAST s.r.o.
> +remarks:	VPN provider, fake location (KP)
> +newcountry:	A1
> +
> +net:		5.62.61.64/30
> +descr:		Privax LTD/AVAST s.r.o.
> +remarks:	VPN provider, fake location (KP)
> +newcountry:	A1
> +
>  net:		5.249.160.0/24
>  descr:		VPNTunnel
>  remarks:	VPN provider
> @@ -226,6 +236,11 @@ descr:		GZ Systems Limited/PureVPN
>  remarks:	VPN provider
>  newcountry:	A1
> =20
> +net:		45.42.151.0/24
> +descr:		Manpo ISP/OppoBox LLC/Roya Hosting
> +remarks:	VPN provider [high confidence, but not proofed], fake location (K=
P)
> +newcountry:	A1
> +
>  net:		46.243.136.0/24
>  descr:		GZ Systems Limited/PureVPN
>  remarks:	VPN provider
> @@ -626,6 +641,11 @@ descr:		Secure Internet LLC
>  remarks:	VPN provider [high confidence, same contact person as for GZ Syst=
ems Ltd., but not proofed]
>  newcountry:	A1
> =20
> +net:		172.97.82.128/25
> +descr:		Fiber Galaxy/Manpo ISP
> +remarks:	VPN provider [high confidence, but not proofed], fake location (K=
P)
> +newcountry:	A1
> +
>  net:		173.239.207.0/24
>  descr:		ExpressVPN
>  remarks:	VPN provider
> @@ -676,6 +696,11 @@ descr:		Sys11 VPN Services UG (haftungsbeschraenkt)
>  remarks:	VPN provider
>  newcountry:	A1
> =20
> +net:		185.56.163.144/28
> +descr:		Easy Networks Solutions OU/VPNFacile
> +remarks:	VPN provider [high confidence, but not proofed], fake location (K=
P)
> +newcountry:	A1
> +
>  net:		185.161.200.0/23
>  descr:		ProtonVPN AG
>  remarks:	VPN provider
> diff --git a/country-overrides/override-other.txt b/country-overrides/overr=
ide-other.txt
> index 1a83829..edb88a3 100644
> --- a/country-overrides/override-other.txt
> +++ b/country-overrides/override-other.txt
> @@ -66,3 +66,8 @@ descr:		IPv6 localhost address
>  remarks:	must not be added to the database
>  newcountry:
> =20
> +# networks with faked location
> +net:		88.151.117.0/24
> +descr:		Golden Internet LLC
> +remarks:	fake location (KP), WHOIS contact points to RU
> +newcountry:	RU
>=20

--=20
Microsoft DNS service terminates abnormally when it recieves a response
to a DNS query that was never made.  Fix Information: Run your DNS
service on a different platform.
		-- bugtraq

--===============9076506988286578501==--