overrides/override-xd.txt

   1 #
   2 # override-xd [.txt]
   3 #
   4 # This file contains Autonomous Systems and IP networks strongly believed or proofed to be hostile,
   5 # posing a _technical_ threat against libloc users in general and/or IPFire users in particular.
   6 #
   7 # libloc neither was intended to be an "opinionated" database, nor should it become that way. Please
   8 # refer to commit 69b3d894fbee6e94afc2a79593f7f6b300b88c10 for the rationale of implementing a special
   9 # flag for hostile networks.
  10 #
  11 # Technical threats cover publicly routable network infrastructure solely dedicated or massively abused to
  12 # host phishing, malware, C&C servers, non-benign vulnerability scanners, or being used as a "bulletproof"
  13 # hosting space for cybercrime infrastructure.
  14 #
  15 # This file should not contain short-lived threats being hosted within legitimate infrastructures, as
  16 # libloc it neither intended nor suitable to protect against such threats in a timely manner - by default,
  17 # clients download a new database once a week.
  18 #
  19 # Networks posing non-technical threats - i. e. not covered by the definition above - must not be listed
  20 # here.
  21 #
  22 # Improvement suggestions are appreciated, please submit them as patches to the location mailing
  23 # list. Refer to https://lists.ipfire.org/mailman/listinfo/location and https://wiki.ipfire.org/devel/contact
  24 # for further information.
  25 #
  26 # Please keep this file sorted.
  27 #
  28
  29 aut-num:        AS7586
  30 descr:          Cloudfort IT
  31 remarks:        part of the "Asline" IP hijacking gang
  32 drop:           yes
  33
  34 aut-num:        AS15828
  35 descr:          Blue Diamond Network Co., Ltd.
  36 remarks:        Shady ISP hosting brute-force login attempt machines galore, claims GB or IR for it's prefixes, but they all end up near Vilnius, LT
  37 country:        LT
  38 drop:           yes
  39
  40 aut-num:        AS18013
  41 descr:          ASLINE LIMITED
  42 remarks:        IP hijacker, traces back to HK
  43 country:        HK
  44 drop:           yes
  45
  46 aut-num:        AS24567
  47 descr:          QT Inc.
  48 remarks:        IP hijacker operating out of AP area (HK or TW?)
  49 country:        AP
  50 drop:           yes
  51
  52 aut-num:        AS35029
  53 descr:          WebLine LTD
  54 remarks:        Rogue ISP
  55 country:        RU
  56 drop:           yes
  57
  58 aut-num:        AS39770
  59 descr:          1337TEAM LIMITED / eliteteam[.]to
  60 remarks:        Bulletproof ISP
  61 drop:           yes
  62
  63 aut-num:        AS40193
  64 descr:          Trit Networks, LLC
  65 remarks:        all cybercrime hosting, all the time
  66 country:        US
  67 drop:           yes
  68
  69 aut-num:        AS41564
  70 descr:          Orion Network Limited
  71 remarks:        shady uplink for a bunch of dirty ISPs, routing stolen AfriNIC networks
  72 drop:           yes
  73
  74 aut-num:        AS41909
  75 descr:          PINVDS OU
  76 remarks:        all cybercrime hosting, all the time
  77 country:        RU
  78 drop:           yes
  79
  80 aut-num:        AS43092
  81 descr:          Kirin Communication Limited
  82 remarks:        Hijacks IP space and tampers with RIR data, traces back to JP
  83 country:        JP
  84 drop:           yes
  85
  86 aut-num:        AS44446
  87 descr:          OOO SibirInvest
  88 remarks:        bulletproof ISP (related to AS202425 and AS57717) located in NL
  89 country:        NL
  90 drop:           yes
  91
  92 aut-num:        AS44477
  93 descr:          STARK INDUSTRIES SOLUTIONS LTD
  94 remarks:        Rogue ISP in multiple locations, some RIR data contain garbage
  95 drop:           yes
  96
  97 aut-num:        AS47154
  98 descr:          HUSAM A. H. HIJAZI
  99 remarks:        Rogue ISP located in NL
 100 country:        NL
 101 drop:           yes
 102
 103 aut-num:        AS48090
 104 descr:          PPTECHNOLOGY LIMITED
 105 remarks:        bulletproof ISP (related to AS204655) located in NL
 106 country:        NL
 107 drop:           yes
 108
 109 aut-num:        AS48950
 110 descr:          GLOBAL COLOCATION LIMITED
 111 remarks:        Part of the "Fiber Grid" IP hijacking / dirty hosting operation, RIR data cannot be trusted
 112 country:        EU
 113 drop:           yes
 114
 115 aut-num:        AS49447
 116 descr:          Nice IT Services Group Inc.
 117 remarks:        Rogue ISP
 118 drop:           yes
 119
 120 aut-num:        AS49870
 121 descr:          Alsycon BV
 122 remarks:        Shady ISP (related to AS204655 et al., same postal address) located in NL, but some RIR data for announced prefixes contain garbage
 123 country:        NL
 124 drop:           yes
 125
 126 aut-num:        AS49466
 127 descr:          KLAYER LLC
 128 remarks:        part of the "Asline" IP hijacking gang, traces back to San Jose, CR
 129 country:        CR
 130 drop:           yes
 131
 132 aut-num:        AS49943
 133 descr:          IT Resheniya LLC
 134 remarks:        Rogue ISP
 135 drop:           yes
 136
 137 aut-num:        AS51381
 138 descr:          1337TEAM LIMITED / eliteteam[.]to
 139 remarks:        Bulletproof ISP
 140 country:        RU
 141 drop:           yes
 142
 143 aut-num:        AS53727
 144 descr:          Netsys Global Telecom Limited (?)
 145 remarks:        Hijacked AS announced out of some location in AP, possibly HK
 146 country:        AP
 147 drop:           yes
 148
 149 aut-num:        AS54600
 150 descr:          PEG TECH INC
 151 remarks:        ISP and IP hijacker located in US this time, tampers with RIR data
 152 country:        US
 153 drop:           yes
 154
 155 aut-num:        AS55020
 156 descr:          Aodao Inc
 157 remarks:        part of the "Asline" IP hijacking gang (?), tampers with RIR data, traces back to HK
 158 country:        HK
 159 drop:           yes
 160
 161 aut-num:        AS55303
 162 descr:          Eagle Sky Co., Lt[d ?]
 163 remarks:        Autonomous System registered to offshore company, abuse contact is a freemail address, address says "0 Market Square, P.O. Box 364, Belize", seems to trace to some location in AP vicinity
 164 country:        AP
 165 drop:           yes
 166
 167 aut-num:        AS55933
 168 descr:          Cloudie Limited
 169 remarks:        part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to HK
 170 country:        HK
 171 drop:           yes
 172
 173 aut-num:        AS57509
 174 descr:          L&L Investment Ltd.
 175 remarks:        another shady customer of "Tamatiya EOOD / 4Vendeta"
 176 country:        BG
 177 drop:           yes
 178
 179 aut-num:        AS56611
 180 descr:          REBA Communications BV
 181 remarks:        bulletproof ISP (related to AS202425) located in NL
 182 country:        NL
 183 drop:           yes
 184
 185 aut-num:        AS56873
 186 descr:          1337TEAM LIMITED / eliteteam[.]to
 187 remarks:        Bulletproof ISP
 188 drop:           yes
 189
 190 aut-num:        AS57416
 191 descr:          LLC South Internet
 192 remarks:        Bulletproof ISP
 193 drop:           yes
 194
 195 aut-num:        AS57523
 196 descr:          Chang Way Technologies Co. Limited
 197 remarks:        Bulletproof ISP
 198 country:        RU
 199 drop:           yes
 200
 201 aut-num:        AS57717
 202 descr:          FiberXpress BV
 203 remarks:        bulletproof ISP (related to AS202425) located in NL
 204 country:        NL
 205 drop:           yes
 206
 207 aut-num:        AS57858
 208 descr:          Inter Connects Inc.
 209 remarks:        part of a dirty ISP conglomerate operating most likely out of SE, hijacking stolen AfriNIC networks, massively tampers with RIR data
 210 country:        SE
 211 drop:           yes
 212
 213 aut-num:        AS57972
 214 descr:          Inter Connects Inc.
 215 remarks:        part of a dirty ISP conglomerate operating most likely out of SE, hijacking stolen AfriNIC networks, massively tampers with RIR data
 216 country:        SE
 217 drop:           yes
 218
 219 aut-num:        AS58271
 220 descr:          FOP Gubina Lubov Petrivna
 221 remarks:        bulletproof ISP operating from a war zone in eastern UA
 222 country:        UA
 223 drop:           yes
 224
 225 aut-num:        AS58810
 226 descr:          iZus Co., Ltd
 227 remarks:        Autonomous System registered to offshore company, abuse contact is a freemail address, seems to trace to some location in AP vicinity
 228 country:        AP
 229 drop:           yes
 230
 231 aut-num:        AS58931
 232 descr:          24.hk global BGP
 233 remarks:        Part of the "ASLINE" IP hijacking operation
 234 country:        HK
 235 drop:           yes
 236
 237 aut-num:        AS59425
 238 descr:          HORIZON LLC
 239 remarks:        Rogue ISP
 240 drop:           yes
 241
 242 aut-num:        AS59753
 243 descr:          Vault Dweller OU
 244 remarks:        bulletproof ISP (related to AS57717) located in NL
 245 country:        NL
 246 drop:           yes
 247
 248 aut-num:        AS59940
 249 descr:          Kanzas LLC
 250 remarks:        Rogue ISP
 251 drop:           yes
 252
 253 aut-num:        AS60424
 254 descr:          1337TEAM LIMITED / eliteteam[.]to
 255 remarks:        Owned by an offshore letterbox company, suspected rogue ISP
 256 drop:           yes
 257
 258 aut-num:        AS60485
 259 descr:          Inter Connects Inc. / Jing Yun
 260 remarks:        part of a dirty ISP conglomerate operating most likely out of SE, hijacking AfriNIC networks
 261 country:        SE
 262 drop:           yes
 263
 264 aut-num:        AS60930
 265 descr:          Intem LLC
 266 remarks:        leaf AS with upstream to other dirty hosters, brute-force attacks galore
 267 country:        RU
 268 drop:           yes
 269
 270 aut-num:        AS61432
 271 descr:          TOV VAIZ PARTNER
 272 remarks:        Rogue ISP
 273 drop:           yes
 274
 275 aut-num:        AS62068
 276 descr:          SpectraIP B.V.
 277 remarks:        bulletproof ISP (linked to AS202425 et al.) located in NL
 278 country:        NL
 279 drop:           yes
 280
 281 aut-num:        AS64425
 282 descr:          SKB Enterprise B.V.
 283 remarks:        bulletproof ISP (linked to AS202425 et al.) located in NL
 284 country:        NL
 285 drop:           yes
 286
 287 aut-num:        AS133201
 288 descr:          ABCDE GROUP COMPANY LIMITED
 289 remarks:        ISP and/or IP hijacker located in HK
 290 country:        HK
 291 drop:           yes
 292
 293 aut-num:        AS135097
 294 descr:          LUOGELANG (FRANCE) LIMITED
 295 remarks:        Shady ISP located in HK, RIR data for announced prefixes contain garbage, solely announcing "Cloud Innovation Ltd." space - no one will miss it
 296 country:        HK
 297 drop:           yes
 298
 299 aut-num:        AS136545
 300 descr:          Blue Data Center
 301 remarks:        IP hijacker located somewhere in AP area, tampers with RIR data
 302 country:        AP
 303 drop:           yes
 304
 305 aut-num:        AS136800
 306 descr:          ICIDC NETWORK
 307 remarks:        IP hijacker located in HK, suspected to be part of the "Asline" IP hijacking gang, tampers with RIR data
 308 country:        HK
 309 drop:           yes
 310
 311 aut-num:        AS137443
 312 descr:          Anchnet Asia Limited
 313 remarks:        IP hijacker located in HK, tampers with RIR data
 314 country:        HK
 315 drop:           yes
 316
 317 aut-num:        AS137523
 318 descr:          HONGKONG CLOUD NETWORK TECHNOLOGY CO., LIMITED
 319 remarks:        ISP and IP hijacker located in HK, tampers with RIR data
 320 country:        HK
 321 drop:           yes
 322
 323 aut-num:        AS137951
 324 descr:          Clayer Limited
 325 remarks:        part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to HK
 326 country:        HK
 327 drop:           yes
 328
 329 aut-num:        AS138648
 330 descr:          ASLINE Global Exchange
 331 remarks:        IP hijacker located in HK
 332 country:        HK
 333 drop:           yes
 334
 335 aut-num:        AS139330
 336 descr:          SANREN DATA LIMITED
 337 remarks:        IP hijacker located somewhere in AP region, tampers with RIR data
 338 country:        AP
 339 drop:           yes
 340
 341 aut-num:        AS140107
 342 descr:          CITIS CLOUD GROUP LIMITED
 343 remarks:        part of the "Asline" IP hijacking gang, tampers with RIR data
 344 country:        AP
 345 drop:           yes
 346
 347 aut-num:        AS140227
 348 descr:          Hong Kong Communications International Co., Limited
 349 remarks:        part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to AP region
 350 country:        AP
 351 drop:           yes
 352
 353 aut-num:        AS141159
 354 descr:          Incomparable(HK)Network Co., Limited
 355 remarks:        ISP and IP hijacker located in HK, tampers with RIR data
 356 country:        HK
 357 drop:           yes
 358
 359 aut-num:        AS141746
 360 descr:          Orenji Server
 361 remarks:        IP hijacker located somewhere in AP area (JP?)
 362 country:        AP
 363 drop:           yes
 364
 365 aut-num:        AS141759
 366 descr:          HONGKONG XING TONG HUI TECHNOLOGY CO.,LIMITED
 367 remarks:        Dirty ISP located in NL
 368 country:        NL
 369 drop:           yes
 370
 371 aut-num:        AS200313
 372 descr:          IT WEB LTD
 373 remarks:        All bulletproof/cybercrime hosting, all the time, not a safe AS to connect to
 374 drop:           yes
 375
 376 aut-num:        AS200391
 377 descr:          KREZ 999 EOOD
 378 remarks:        another shady customer of "Tamatiya EOOD / 4Vendeta", located in BG, tampers with RIR data
 379 country:        BG
 380 drop:           yes
 381
 382 aut-num:        AS202325
 383 descr:          4Media Ltd.
 384 remarks:        another shady customer of "Tamatiya EOOD / 4Vendeta", located in BG, tampers with RIR data
 385 country:        BG
 386 drop:           yes
 387
 388 aut-num:        AS202425
 389 descr:          IP Volume Inc.
 390 remarks:        bulletproof ISP (aka: AS29073 / Ecatel Ltd. / Quasi Networks Ltd.) located in NL
 391 country:        NL
 392 drop:           yes
 393
 394 aut-num:        AS202769
 395 descr:          NETSTYLE A. LTD
 396 remarks:        bulletproof ISP and IP hijacker, related to AS202425 and AS62355, traces to NL
 397 country:        NL
 398 drop:           yes
 399
 400 aut-num:        AS204353
 401 descr:          Global Offshore Limited
 402 remarks:        part of a dirty ISP conglomerate with links to SE, RIR data of prefixes announced by this AS cannot be trusted
 403 country:        EU
 404 drop:           yes
 405
 406 aut-num:        AS204428
 407 descr:          SS-Net
 408 remarks:        another shady customer of "Tamatiya EOOD / 4Vendeta", located in BG, tampers with RIR data
 409 country:        BG
 410 drop:           yes
 411
 412 aut-num:        AS204603
 413 descr:          Partner LLC / LetHost LLC
 414 remarks:        Bulletproof ISP
 415 drop:           yes
 416
 417 aut-num:        AS204655
 418 descr:          Novogara Ltd.
 419 remarks:        bulletproof ISP (strongly linked to AS202425) located in NL
 420 country:        NL
 421 drop:           yes
 422
 423 aut-num:        AS206728
 424 descr:          Media Land LLC
 425 remarks:        bulletproof ISP, see: https://krebsonsecurity.com/2019/07/meet-the-worlds-biggest-bulletproof-hoster/
 426 country:        RU
 427 drop:           yes
 428
 429 aut-num:        AS207566
 430 descr:          Chang Way Technologies Co. Limited
 431 remarks:        Rogue ISP
 432 country:        RU
 433 drop:           yes
 434
 435 aut-num:        AS209160
 436 descr:          Miti 2000 EOOD
 437 remarks:        another shady customer of "Tamatiya EOOD / 4Vendeta", located in BG, tampers with RIR data
 438 country:        BG
 439 drop:           yes
 440
 441 aut-num:        AS209272
 442 descr:          Alviva Holding Limited
 443 remarks:        bulletproof ISP operating from a war zone in eastern UA
 444 country:        UA
 445 drop:           yes
 446
 447 aut-num:        AS209559
 448 descr:          XHOST INTERNET SOLUTIONS LP
 449 remarks:        Rogue ISP (linked to AS202425) located in NL
 450 country:        NL
 451 drop:           yes
 452
 453 aut-num:        AS210352
 454 descr:          Partner LLC
 455 remarks:        All cybercrime hosting, all the time
 456 country:        RU
 457 drop:           yes
 458
 459 aut-num:        AS210644
 460 descr:          AEZA GROUP Ltd
 461 remarks:        In all networks currently propagated by this AS, one is unable to find anything that has even a patina of legitimacy
 462 country:        RU
 463 drop:           yes
 464
 465 aut-num:        AS210848
 466 descr:          Telkom Internet LTD
 467 remarks:        Rogue ISP (linked to AS202425) located in NL
 468 country:        NL
 469 drop:           yes
 470
 471 aut-num:        AS211059
 472 descr:          Tribeka Web Advisors S.A.
 473 remarks:        Dirty ISP, see individual network entries below
 474 drop:           yes
 475
 476 aut-num:        AS211193
 477 descr:          ABDILAZIZ UULU ZHUSUP
 478 remarks:        bulletproof ISP and IP hijacker, traces to RU
 479 country:        RU
 480 drop:           yes
 481
 482 aut-num:        AS211252
 483 descr:          Delis LLC
 484 remarks:        Bulletproof Serverion customer in NL, many RIR data for announced prefixes contain garbage
 485 country:        NL
 486 drop:           yes
 487
 488 aut-num:        AS211138
 489 descr:          Private-Hosting di Cipriano Oscar
 490 remarks:        Bulletproof combahton GmbH customer in DE
 491 country:        DE
 492 drop:           yes
 493
 494 aut-num:        AS211805
 495 descr:          Media Land LLC
 496 remarks:        bulletproof ISP, see: https://krebsonsecurity.com/2019/07/meet-the-worlds-biggest-bulletproof-hoster/
 497 country:        RU
 498 drop:           yes
 499
 500 aut-num:        AS211849
 501 descr:          Kakharov Orinbassar Maratuly
 502 remarks:        ISP and IP hijacker located in KZ, many RIR data for announced prefixes contain garbage
 503 country:        KZ
 504 drop:           yes
 505
 506 aut-num:        AS212283
 507 descr:          ROZA HOLIDAYS EOOD
 508 remarks:        another shady customer of "Tamatiya EOOD / 4Vendeta", located in BG
 509 country:        BG
 510 drop:           yes
 511
 512 aut-num:        AS212552
 513 descr:          BitCommand LLC
 514 remarks:        Dirty ISP located somewhere in EU, cannot trust RIR data of this network
 515 country:        EU
 516 drop:           yes
 517
 518 aut-num:        AS213010
 519 descr:          GigaHostingServices OU
 520 remarks:        Does not appear to host any legitimate infrastructure whatsoever, just mass brute-force login attempts
 521 country:        PL
 522 drop:           yes
 523
 524 aut-num:        AS213058
 525 descr:          Private Internet Hosting LTD
 526 remarks:        bulletproof ISP located in RU
 527 country:        RU
 528 drop:           yes
 529
 530 aut-num:        AS213194
 531 descr:          Alfa Web Solutions Ltd
 532 remarks:        Rogue ISP (linked to AS57717) located in NL
 533 country:        NL
 534 drop:           yes
 535
 536 aut-num:        AS213254
 537 descr:          OOO RAIT TELECOM
 538 remarks:        Bulletproof connectivity procurer for AS51381
 539 country:        RU
 540 drop:           yes
 541
 542 aut-num:        AS328543
 543 descr:          Sun Network Company Limited
 544 remarks:        IP hijacker, traces back to AP region
 545 country:        AP
 546 drop:           yes
 547
 548 aut-num:        AS328671
 549 descr:          Datapacket Maroc SARL
 550 remarks:        bulletproof ISP (strongly linked to AS202425) located in NL
 551 country:        NL
 552 drop:           yes
 553
 554 aut-num:        AS393889
 555 descr:          EightJoy Network LLC
 556 remarks:        Most likely hijacked or criminal AS
 557 country:        HK
 558 drop:           yes
 559
 560 aut-num:        AS398478
 561 descr:          PEG TECH INC
 562 remarks:        ISP located in HK, part of the ASLINE IP hijacking gang (?), tampers with RIR data
 563 country:        HK
 564 drop:           yes
 565
 566 aut-num:        AS398993
 567 descr:          PEG TECH INC
 568 remarks:        ISP located in JP, tampers with RIR data
 569 country:        JP
 570 drop:           yes
 571
 572 aut-num:        AS399195
 573 descr:          PEG TECH INC
 574 remarks:        ISP located in KR, tampers with RIR data
 575 country:        KR
 576 drop:           yes
 577
 578 aut-num:        AS399674
 579 descr:          INTERNET HOSTSPACE GLOBAL INC
 580 remarks:        Shady ISP located in US, solely announcing "Cloud Innovation Ltd." space - no one will miss it
 581 country:        US
 582 drop:           yes
 583
 584 aut-num:        AS400161
 585 descr:          Academy of Internet Research Limited Liability Company
 586 remarks:        Mass-scanning, apparently without legitimate intention
 587 drop:           yes
 588
 589 aut-num:        AS400506
 590 descr:          Black Apple
 591 remarks:        Solely announces hijacked prefixes out of JP, no legitimate infrastructure
 592 country:        JP
 593 drop:           yes
 594
 595 net:            45.143.203.0/24
 596 descr:          TOV VAIZ PARTNER
 597 remarks:        Attack network tracing back to NL
 598 country:        NL
 599 drop:           yes
 600
 601 net:            61.177.172.0/23
 602 descr:          CHINANET jiangsu province network
 603 remarks:        Since July 27, 2022, this network conducts mass brute-force attacks galore
 604 drop:           yes
 605
 606 net:            89.23.103.0/24
 607 descr:          Media Land LLC / abuse-server[.]su
 608 remarks:        bulletproof ISP, see: https://krebsonsecurity.com/2019/07/meet-the-worlds-biggest-bulletproof-hoster/
 609 drop:           yes
 610
 611 net:            91.240.243.0/24
 612 descr:          Media Land LLC
 613 remarks:        bulletproof ISP, see: https://krebsonsecurity.com/2019/07/meet-the-worlds-biggest-bulletproof-hoster/
 614 drop:           yes
 615
 616 net:            92.63.196.0/24
 617 descr:          TOV VAIZ PARTNER / Perfect Hosting Solutions
 618 remarks:        Attack network tracing back to NL
 619 country:        NL
 620 drop:           yes
 621
 622 net:            103.176.21.0/24
 623 descr:          GIAP BICH NGOC COMMUNICATION COMPANY LIMITED
 624 remarks:        Brute-force attack network
 625 drop:           yes
 626
 627 net:            109.206.241.0/24
 628 descr:          Serverion B.V.
 629 remarks:        Leased to Neterra, all cybercrime, all the time
 630 drop:           yes
 631
 632 net:            111.7.96.0/24
 633 descr:          China Mobile Communications Corporation
 634 remarks:        Brute-force attack network
 635 drop:           yes
 636
 637 net:            114.246.10.0/24
 638 descr:          China Unicom Beijing province network
 639 remarks:        Brute-force attack network
 640 drop:           yes
 641
 642 net:            116.7.245.0/24
 643 descr:          CHINANET Guangdong province network
 644 remarks:        Brute-force attack network
 645 drop:           yes
 646
 647 net:            116.57.185.0/24
 648 descr:          China Education and Research Network
 649 remarks:        Brute-force attack network
 650 drop:           yes
 651
 652 net:            123.160.220.0/22
 653 descr:          CHINANET henan province network
 654 remarks:        Brute-force attack network
 655 drop:           yes
 656
 657 net:            154.89.5.0/24
 658 descr:          Agotoz HK Limited
 659 remarks:        Brute-force attack network
 660 drop:           yes
 661
 662 net:            185.156.72.0/24
 663 descr:          TOV VAIZ PARTNER / InterHost
 664 remarks:        Attack network tracing back to UA
 665 country:        UA
 666 drop:           yes
 667
 668 net:            185.196.220.0/24
 669 descr:          Makut Investments
 670 remarks:        Brute-force attack network
 671 drop:           yes
 672
 673 net:            193.201.9.0/24
 674 descr:          Infolink LLC
 675 remarks:        Based on domains ending up there, this network is entirely malicious
 676 drop:           yes
 677
 678 net:            195.133.20.0/24
 679 descr:          Tribeka Web Advisors S.A.
 680 remarks:        Tampers with RIR data, traces back to NL, not a safe place to route traffic to
 681 country:        NL
 682 drop:           yes
 683
 684 net:            194.135.24.0/24
 685 descr:          Tribeka Web Advisors S.A.
 686 remarks:        Tampers with RIR data, traces back to US, not a safe place to route traffic to
 687 country:        US
 688 drop:           yes
 689
 690 net:            196.11.32.0/20
 691 descr:          Sanlam Life Insurance Limited
 692 remarks:        Stolen AfriNIC IPv4 space announced from NL?
 693 country:        NL
 694 drop:           yes
 695
 696 net:            2a0e:b107:17fe::/47
 697 descr:          Amarai-Network - Location Test @ Antarctic
 698 remarks:        Tampers with RIR data, not a safe place to route traffic to
 699 drop:           yes
 700
 701 net:            2a0e:b107:d10::/44
 702 descr:          NZB.si Enterprises
 703 remarks:        Tampers with RIR data, not a safe place to route traffic to
 704 drop:           yes
 705
 706 net:            2a0f:7a80::/29
 707 descr:          ASLINE Limited
 708 remarks:        APNIC chunk owned by a HK-based IP hijacker, but assigned to DE
 709 country:        HK
 710 drop:           yes
 711
 712 net:            2a10:9700::/29
 713 descr:          1337TEAM LIMITED / eliteteam[.]to
 714 remarks:        Owned by an offshore letterbox company, suspected rogue ISP
 715 country:        RU
 716 drop:           yes