overrides/override-xd.txt

   1 #
   2 # override-xd [.txt]
   3 #
   4 # This file contains Autonomous Systems and IP networks strongly believed or proofed to be hostile,
   5 # posing a _technical_ threat against libloc users in general and/or IPFire users in particular.
   6 #
   7 # libloc neither was intended to be an "opinionated" database, nor should it become that way. Please
   8 # refer to commit 69b3d894fbee6e94afc2a79593f7f6b300b88c10 for the rationale of implementing a special
   9 # flag for hostile networks.
  10 #
  11 # Technical threats cover publicly routable network infrastructure solely dedicated or massively abused to
  12 # host phishing, malware, C&C servers, non-benign vulnerability scanners, or being used as a "bulletproof"
  13 # hosting space for cybercrime infrastructure.
  14 #
  15 # This file should not contain short-lived threats being hosted within legitimate infrastructures, as
  16 # libloc it neither intended nor suitable to protect against such threats in a timely manner - by default,
  17 # clients download a new database once a week.
  18 #
  19 # Networks posing non-technical threats - i. e. not covered by the definition above - must not be listed
  20 # here.
  21 #
  22 # Improvement suggestions are appreciated, please submit them as patches to the location mailing
  23 # list. Refer to https://lists.ipfire.org/mailman/listinfo/location and https://wiki.ipfire.org/devel/contact
  24 # for further information.
  25 #
  26 # Please keep this file sorted.
  27 #
  28
  29 aut-num:        AS7586
  30 descr:          Cloudfort IT
  31 remarks:        part of the "Asline" IP hijacking gang
  32 drop:           yes
  33
  34 aut-num:        AS15828
  35 descr:          Blue Diamond Network Co., Ltd.
  36 remarks:        Shady ISP hosting brute-force login attempt machines galore, claims GB or IR for it's prefixes, but they all end up near Vilnius, LT
  37 country:        LT
  38 drop:           yes
  39
  40 aut-num:        AS18013
  41 descr:          ASLINE LIMITED
  42 remarks:        IP hijacker, traces back to HK
  43 country:        HK
  44 drop:           yes
  45
  46 aut-num:        AS24567
  47 descr:          QT Inc.
  48 remarks:        IP hijacker operating out of AP area (HK or TW?)
  49 country:        AP
  50 drop:           yes
  51
  52 aut-num:        AS35029
  53 descr:          WebLine LTD
  54 remarks:        Rogue ISP
  55 country:        RU
  56 drop:           yes
  57
  58 aut-num:        AS39770
  59 descr:          1337TEAM LIMITED / eliteteam[.]to
  60 remarks:        Bulletproof ISP
  61 drop:           yes
  62
  63 aut-num:        AS40193
  64 descr:          Trit Networks, LLC
  65 remarks:        all cybercrime hosting, all the time
  66 country:        US
  67 drop:           yes
  68
  69 aut-num:        AS41564
  70 descr:          Orion Network Limited
  71 remarks:        shady uplink for a bunch of dirty ISPs, routing stolen AfriNIC networks
  72 drop:           yes
  73
  74 aut-num:        AS41909
  75 descr:          PINVDS OU
  76 remarks:        all cybercrime hosting, all the time
  77 country:        RU
  78 drop:           yes
  79
  80 aut-num:        AS43092
  81 descr:          Kirin Communication Limited
  82 remarks:        Hijacks IP space and tampers with RIR data, traces back to JP
  83 country:        JP
  84 drop:           yes
  85
  86 aut-num:        AS44446
  87 descr:          OOO SibirInvest
  88 remarks:        bulletproof ISP (related to AS202425 and AS57717) located in NL
  89 country:        NL
  90 drop:           yes
  91
  92 aut-num:        AS44477
  93 descr:          STARK INDUSTRIES SOLUTIONS LTD
  94 remarks:        Rogue ISP in multiple locations, some RIR data contain garbage
  95 drop:           yes
  96
  97 aut-num:        AS47154
  98 descr:          HUSAM A. H. HIJAZI
  99 remarks:        Rogue ISP located in NL
 100 country:        NL
 101 drop:           yes
 102
 103 aut-num:        AS48090
 104 descr:          PPTECHNOLOGY LIMITED
 105 remarks:        bulletproof ISP (related to AS204655) located in NL
 106 country:        NL
 107 drop:           yes
 108
 109 aut-num:        AS48950
 110 descr:          GLOBAL COLOCATION LIMITED
 111 remarks:        Part of the "Fiber Grid" IP hijacking / dirty hosting operation, RIR data cannot be trusted
 112 country:        EU
 113 drop:           yes
 114
 115 aut-num:        AS49447
 116 descr:          Nice IT Services Group Inc.
 117 remarks:        Rogue ISP
 118 drop:           yes
 119
 120 aut-num:        AS49870
 121 descr:          Alsycon BV
 122 remarks:        Shady ISP (related to AS204655 et al., same postal address) located in NL, but some RIR data for announced prefixes contain garbage
 123 country:        NL
 124 drop:           yes
 125
 126 aut-num:        AS49466
 127 descr:          KLAYER LLC
 128 remarks:        part of the "Asline" IP hijacking gang, traces back to San Jose, CR
 129 country:        CR
 130 drop:           yes
 131
 132 aut-num:        AS49943
 133 descr:          IT Resheniya LLC
 134 remarks:        Rogue ISP
 135 drop:           yes
 136
 137 aut-num:        AS51381
 138 descr:          1337TEAM LIMITED / eliteteam[.]to
 139 remarks:        Bulletproof ISP
 140 country:        RU
 141 drop:           yes
 142
 143 aut-num:        AS53727
 144 descr:          Netsys Global Telecom Limited (?)
 145 remarks:        Hijacked AS announced out of some location in AP, possibly HK
 146 country:        AP
 147 drop:           yes
 148
 149 aut-num:        AS54600
 150 descr:          PEG TECH INC
 151 remarks:        ISP and IP hijacker located in US this time, tampers with RIR data
 152 country:        US
 153 drop:           yes
 154
 155 aut-num:        AS55020
 156 descr:          Aodao Inc
 157 remarks:        part of the "Asline" IP hijacking gang (?), tampers with RIR data, traces back to HK
 158 country:        HK
 159 drop:           yes
 160
 161 aut-num:        AS55303
 162 descr:          Eagle Sky Co., Lt[d ?]
 163 remarks:        Autonomous System registered to offshore company, abuse contact is a freemail address, address says "0 Market Square, P.O. Box 364, Belize", seems to trace to some location in AP vicinity
 164 country:        AP
 165 drop:           yes
 166
 167 aut-num:        AS55933
 168 descr:          Cloudie Limited
 169 remarks:        part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to HK
 170 country:        HK
 171 drop:           yes
 172
 173 aut-num:        AS57509
 174 descr:          L&L Investment Ltd.
 175 remarks:        another shady customer of "Tamatiya EOOD / 4Vendeta"
 176 country:        BG
 177 drop:           yes
 178
 179 aut-num:        AS56611
 180 descr:          REBA Communications BV
 181 remarks:        bulletproof ISP (related to AS202425) located in NL
 182 country:        NL
 183 drop:           yes
 184
 185 aut-num:        AS56873
 186 descr:          1337TEAM LIMITED / eliteteam[.]to
 187 remarks:        Bulletproof ISP
 188 drop:           yes
 189
 190 aut-num:        AS57416
 191 descr:          LLC South Internet
 192 remarks:        Bulletproof ISP
 193 drop:           yes
 194
 195 aut-num:        AS57523
 196 descr:          Chang Way Technologies Co. Limited
 197 remarks:        Bulletproof ISP
 198 country:        RU
 199 drop:           yes
 200
 201 aut-num:        AS57717
 202 descr:          FiberXpress BV
 203 remarks:        bulletproof ISP (related to AS202425) located in NL
 204 country:        NL
 205 drop:           yes
 206
 207 aut-num:        AS57858
 208 descr:          Inter Connects Inc.
 209 remarks:        part of a dirty ISP conglomerate operating most likely out of SE, hijacking stolen AfriNIC networks, massively tampers with RIR data
 210 country:        SE
 211 drop:           yes
 212
 213 aut-num:        AS57972
 214 descr:          Inter Connects Inc.
 215 remarks:        part of a dirty ISP conglomerate operating most likely out of SE, hijacking stolen AfriNIC networks, massively tampers with RIR data
 216 country:        SE
 217 drop:           yes
 218
 219 aut-num:        AS58271
 220 descr:          FOP Gubina Lubov Petrivna
 221 remarks:        bulletproof ISP operating from a war zone in eastern UA
 222 country:        UA
 223 drop:           yes
 224
 225 aut-num:        AS58810
 226 descr:          iZus Co., Ltd
 227 remarks:        Autonomous System registered to offshore company, abuse contact is a freemail address, seems to trace to some location in AP vicinity
 228 country:        AP
 229 drop:           yes
 230
 231 aut-num:        AS58931
 232 descr:          24.hk global BGP
 233 remarks:        Part of the "ASLINE" IP hijacking operation
 234 country:        HK
 235 drop:           yes
 236
 237 aut-num:        AS59425
 238 descr:          HORIZON LLC
 239 remarks:        Rogue ISP
 240 drop:           yes
 241
 242 aut-num:        AS59753
 243 descr:          Vault Dweller OU
 244 remarks:        bulletproof ISP (related to AS57717) located in NL
 245 country:        NL
 246 drop:           yes
 247
 248 aut-num:        AS59940
 249 descr:          Kanzas LLC
 250 remarks:        Rogue ISP
 251 drop:           yes
 252
 253 aut-num:        AS60424
 254 descr:          1337TEAM LIMITED / eliteteam[.]to
 255 remarks:        Owned by an offshore letterbox company, suspected rogue ISP
 256 drop:           yes
 257
 258 aut-num:        AS60485
 259 descr:          Inter Connects Inc. / Jing Yun
 260 remarks:        part of a dirty ISP conglomerate operating most likely out of SE, hijacking AfriNIC networks
 261 country:        SE
 262 drop:           yes
 263
 264 aut-num:        AS60930
 265 descr:          Intem LLC
 266 remarks:        leaf AS with upstream to other dirty hosters, brute-force attacks galore
 267 country:        RU
 268 drop:           yes
 269
 270 aut-num:        AS61302
 271 descr:          HUIZE LTD
 272 remarks:        Bulletproof ISP
 273 drop:           yes
 274
 275 aut-num:        AS61432
 276 descr:          TOV VAIZ PARTNER
 277 remarks:        Rogue ISP
 278 drop:           yes
 279
 280 aut-num:        AS62068
 281 descr:          SpectraIP B.V.
 282 remarks:        bulletproof ISP (linked to AS202425 et al.) located in NL
 283 country:        NL
 284 drop:           yes
 285
 286 aut-num:        AS64425
 287 descr:          SKB Enterprise B.V.
 288 remarks:        bulletproof ISP (linked to AS202425 et al.) located in NL
 289 country:        NL
 290 drop:           yes
 291
 292 aut-num:        AS133201
 293 descr:          ABCDE GROUP COMPANY LIMITED
 294 remarks:        ISP and/or IP hijacker located in HK
 295 country:        HK
 296 drop:           yes
 297
 298 aut-num:        AS135097
 299 descr:          LUOGELANG (FRANCE) LIMITED
 300 remarks:        Shady ISP located in HK, RIR data for announced prefixes contain garbage, solely announcing "Cloud Innovation Ltd." space - no one will miss it
 301 country:        HK
 302 drop:           yes
 303
 304 aut-num:        AS136545
 305 descr:          Blue Data Center
 306 remarks:        IP hijacker located somewhere in AP area, tampers with RIR data
 307 country:        AP
 308 drop:           yes
 309
 310 aut-num:        AS136800
 311 descr:          ICIDC NETWORK
 312 remarks:        IP hijacker located in HK, suspected to be part of the "Asline" IP hijacking gang, tampers with RIR data
 313 country:        HK
 314 drop:           yes
 315
 316 aut-num:        AS137443
 317 descr:          Anchnet Asia Limited
 318 remarks:        IP hijacker located in HK, tampers with RIR data
 319 country:        HK
 320 drop:           yes
 321
 322 aut-num:        AS137523
 323 descr:          HONGKONG CLOUD NETWORK TECHNOLOGY CO., LIMITED
 324 remarks:        ISP and IP hijacker located in HK, tampers with RIR data
 325 country:        HK
 326 drop:           yes
 327
 328 aut-num:        AS137951
 329 descr:          Clayer Limited
 330 remarks:        part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to HK
 331 country:        HK
 332 drop:           yes
 333
 334 aut-num:        AS138648
 335 descr:          ASLINE Global Exchange
 336 remarks:        IP hijacker located in HK
 337 country:        HK
 338 drop:           yes
 339
 340 aut-num:        AS139330
 341 descr:          SANREN DATA LIMITED
 342 remarks:        IP hijacker located somewhere in AP region, tampers with RIR data
 343 country:        AP
 344 drop:           yes
 345
 346 aut-num:        AS140107
 347 descr:          CITIS CLOUD GROUP LIMITED
 348 remarks:        part of the "Asline" IP hijacking gang, tampers with RIR data
 349 country:        AP
 350 drop:           yes
 351
 352 aut-num:        AS140227
 353 descr:          Hong Kong Communications International Co., Limited
 354 remarks:        part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to AP region
 355 country:        AP
 356 drop:           yes
 357
 358 aut-num:        AS141159
 359 descr:          Incomparable(HK)Network Co., Limited
 360 remarks:        ISP and IP hijacker located in HK, tampers with RIR data
 361 country:        HK
 362 drop:           yes
 363
 364 aut-num:        AS141746
 365 descr:          Orenji Server
 366 remarks:        IP hijacker located somewhere in AP area (JP?)
 367 country:        AP
 368 drop:           yes
 369
 370 aut-num:        AS141759
 371 descr:          HONGKONG XING TONG HUI TECHNOLOGY CO.,LIMITED
 372 remarks:        Dirty ISP located in NL
 373 country:        NL
 374 drop:           yes
 375
 376 aut-num:        AS200313
 377 descr:          IT WEB LTD
 378 remarks:        All bulletproof/cybercrime hosting, all the time, not a safe AS to connect to
 379 drop:           yes
 380
 381 aut-num:        AS200391
 382 descr:          KREZ 999 EOOD
 383 remarks:        another shady customer of "Tamatiya EOOD / 4Vendeta", located in BG, tampers with RIR data
 384 country:        BG
 385 drop:           yes
 386
 387 aut-num:        AS202325
 388 descr:          4Media Ltd.
 389 remarks:        another shady customer of "Tamatiya EOOD / 4Vendeta", located in BG, tampers with RIR data
 390 country:        BG
 391 drop:           yes
 392
 393 aut-num:        AS202425
 394 descr:          IP Volume Inc.
 395 remarks:        bulletproof ISP (aka: AS29073 / Ecatel Ltd. / Quasi Networks Ltd.) located in NL
 396 country:        NL
 397 drop:           yes
 398
 399 aut-num:        AS202769
 400 descr:          NETSTYLE A. LTD
 401 remarks:        bulletproof ISP and IP hijacker, related to AS202425 and AS62355, traces to NL
 402 country:        NL
 403 drop:           yes
 404
 405 aut-num:        AS204353
 406 descr:          Global Offshore Limited
 407 remarks:        part of a dirty ISP conglomerate with links to SE, RIR data of prefixes announced by this AS cannot be trusted
 408 country:        EU
 409 drop:           yes
 410
 411 aut-num:        AS204428
 412 descr:          SS-Net
 413 remarks:        another shady customer of "Tamatiya EOOD / 4Vendeta", located in BG, tampers with RIR data
 414 country:        BG
 415 drop:           yes
 416
 417 aut-num:        AS204603
 418 descr:          Partner LLC / LetHost LLC
 419 remarks:        Bulletproof ISP
 420 drop:           yes
 421
 422 aut-num:        AS204655
 423 descr:          Novogara Ltd.
 424 remarks:        bulletproof ISP (strongly linked to AS202425) located in NL
 425 country:        NL
 426 drop:           yes
 427
 428 aut-num:        AS206728
 429 descr:          Media Land LLC
 430 remarks:        bulletproof ISP, see: https://krebsonsecurity.com/2019/07/meet-the-worlds-biggest-bulletproof-hoster/
 431 country:        RU
 432 drop:           yes
 433
 434 aut-num:        AS207566
 435 descr:          Chang Way Technologies Co. Limited
 436 remarks:        Rogue ISP
 437 country:        RU
 438 drop:           yes
 439
 440 aut-num:        AS209160
 441 descr:          Miti 2000 EOOD
 442 remarks:        another shady customer of "Tamatiya EOOD / 4Vendeta", located in BG, tampers with RIR data
 443 country:        BG
 444 drop:           yes
 445
 446 aut-num:        AS209272
 447 descr:          Alviva Holding Limited
 448 remarks:        bulletproof ISP operating from a war zone in eastern UA
 449 country:        UA
 450 drop:           yes
 451
 452 aut-num:        AS209559
 453 descr:          XHOST INTERNET SOLUTIONS LP
 454 remarks:        Rogue ISP (linked to AS202425) located in NL
 455 country:        NL
 456 drop:           yes
 457
 458 aut-num:        AS210352
 459 descr:          Partner LLC
 460 remarks:        All cybercrime hosting, all the time
 461 country:        RU
 462 drop:           yes
 463
 464 aut-num:        AS210644
 465 descr:          AEZA GROUP Ltd
 466 remarks:        In all networks currently propagated by this AS, one is unable to find anything that has even a patina of legitimacy
 467 country:        RU
 468 drop:           yes
 469
 470 aut-num:        AS210848
 471 descr:          Telkom Internet LTD
 472 remarks:        Rogue ISP (linked to AS202425) located in NL
 473 country:        NL
 474 drop:           yes
 475
 476 aut-num:        AS211059
 477 descr:          Tribeka Web Advisors S.A.
 478 remarks:        Dirty ISP, see individual network entries below
 479 drop:           yes
 480
 481 aut-num:        AS211193
 482 descr:          ABDILAZIZ UULU ZHUSUP
 483 remarks:        bulletproof ISP and IP hijacker, traces to RU
 484 country:        RU
 485 drop:           yes
 486
 487 aut-num:        AS211252
 488 descr:          Delis LLC
 489 remarks:        Bulletproof Serverion customer in NL, many RIR data for announced prefixes contain garbage
 490 country:        NL
 491 drop:           yes
 492
 493 aut-num:        AS211138
 494 descr:          Private-Hosting di Cipriano Oscar
 495 remarks:        Bulletproof combahton GmbH customer in DE
 496 country:        DE
 497 drop:           yes
 498
 499 aut-num:        AS211805
 500 descr:          Media Land LLC
 501 remarks:        bulletproof ISP, see: https://krebsonsecurity.com/2019/07/meet-the-worlds-biggest-bulletproof-hoster/
 502 country:        RU
 503 drop:           yes
 504
 505 aut-num:        AS211849
 506 descr:          Kakharov Orinbassar Maratuly
 507 remarks:        ISP and IP hijacker located in KZ, many RIR data for announced prefixes contain garbage
 508 country:        KZ
 509 drop:           yes
 510
 511 aut-num:        AS212283
 512 descr:          ROZA HOLIDAYS EOOD
 513 remarks:        another shady customer of "Tamatiya EOOD / 4Vendeta", located in BG
 514 country:        BG
 515 drop:           yes
 516
 517 aut-num:        AS212552
 518 descr:          BitCommand LLC
 519 remarks:        Dirty ISP located somewhere in EU, cannot trust RIR data of this network
 520 country:        EU
 521 drop:           yes
 522
 523 aut-num:        AS213010
 524 descr:          GigaHostingServices OU
 525 remarks:        Does not appear to host any legitimate infrastructure whatsoever, just mass brute-force login attempts
 526 country:        PL
 527 drop:           yes
 528
 529 aut-num:        AS213058
 530 descr:          Private Internet Hosting LTD
 531 remarks:        bulletproof ISP located in RU
 532 country:        RU
 533 drop:           yes
 534
 535 aut-num:        AS213194
 536 descr:          Alfa Web Solutions Ltd
 537 remarks:        Rogue ISP (linked to AS57717) located in NL
 538 country:        NL
 539 drop:           yes
 540
 541 aut-num:        AS213254
 542 descr:          OOO RAIT TELECOM
 543 remarks:        Bulletproof connectivity procurer for AS51381
 544 country:        RU
 545 drop:           yes
 546
 547 aut-num:        AS328543
 548 descr:          Sun Network Company Limited
 549 remarks:        IP hijacker, traces back to AP region
 550 country:        AP
 551 drop:           yes
 552
 553 aut-num:        AS328671
 554 descr:          Datapacket Maroc SARL
 555 remarks:        bulletproof ISP (strongly linked to AS202425) located in NL
 556 country:        NL
 557 drop:           yes
 558
 559 aut-num:        AS393889
 560 descr:          EightJoy Network LLC
 561 remarks:        Most likely hijacked or criminal AS
 562 country:        HK
 563 drop:           yes
 564
 565 aut-num:        AS398478
 566 descr:          PEG TECH INC
 567 remarks:        ISP located in HK, part of the ASLINE IP hijacking gang (?), tampers with RIR data
 568 country:        HK
 569 drop:           yes
 570
 571 aut-num:        AS398993
 572 descr:          PEG TECH INC
 573 remarks:        ISP located in JP, tampers with RIR data
 574 country:        JP
 575 drop:           yes
 576
 577 aut-num:        AS399195
 578 descr:          PEG TECH INC
 579 remarks:        ISP located in KR, tampers with RIR data
 580 country:        KR
 581 drop:           yes
 582
 583 aut-num:        AS399674
 584 descr:          INTERNET HOSTSPACE GLOBAL INC
 585 remarks:        Shady ISP located in US, solely announcing "Cloud Innovation Ltd." space - no one will miss it
 586 country:        US
 587 drop:           yes
 588
 589 aut-num:        AS400161
 590 descr:          Academy of Internet Research Limited Liability Company
 591 remarks:        Mass-scanning, apparently without legitimate intention
 592 drop:           yes
 593
 594 aut-num:        AS400506
 595 descr:          Black Apple
 596 remarks:        Solely announces hijacked prefixes out of JP, no legitimate infrastructure
 597 country:        JP
 598 drop:           yes
 599
 600 net:            45.143.203.0/24
 601 descr:          TOV VAIZ PARTNER
 602 remarks:        Attack network tracing back to NL
 603 country:        NL
 604 drop:           yes
 605
 606 net:            61.177.172.0/23
 607 descr:          CHINANET jiangsu province network
 608 remarks:        Since July 27, 2022, this network conducts mass brute-force attacks galore
 609 drop:           yes
 610
 611 net:            89.23.103.0/24
 612 descr:          Media Land LLC / abuse-server[.]su
 613 remarks:        bulletproof ISP, see: https://krebsonsecurity.com/2019/07/meet-the-worlds-biggest-bulletproof-hoster/
 614 drop:           yes
 615
 616 net:            91.240.243.0/24
 617 descr:          Media Land LLC
 618 remarks:        bulletproof ISP, see: https://krebsonsecurity.com/2019/07/meet-the-worlds-biggest-bulletproof-hoster/
 619 drop:           yes
 620
 621 net:            92.63.196.0/24
 622 descr:          TOV VAIZ PARTNER / Perfect Hosting Solutions
 623 remarks:        Attack network tracing back to NL
 624 country:        NL
 625 drop:           yes
 626
 627 net:            103.176.21.0/24
 628 descr:          GIAP BICH NGOC COMMUNICATION COMPANY LIMITED
 629 remarks:        Brute-force attack network
 630 drop:           yes
 631
 632 net:            109.206.241.0/24
 633 descr:          Serverion B.V.
 634 remarks:        Leased to Neterra, all cybercrime, all the time
 635 drop:           yes
 636
 637 net:            111.7.96.0/24
 638 descr:          China Mobile Communications Corporation
 639 remarks:        Brute-force attack network
 640 drop:           yes
 641
 642 net:            114.246.10.0/24
 643 descr:          China Unicom Beijing province network
 644 remarks:        Brute-force attack network
 645 drop:           yes
 646
 647 net:            116.7.245.0/24
 648 descr:          CHINANET Guangdong province network
 649 remarks:        Brute-force attack network
 650 drop:           yes
 651
 652 net:            116.57.185.0/24
 653 descr:          China Education and Research Network
 654 remarks:        Brute-force attack network
 655 drop:           yes
 656
 657 net:            123.160.220.0/22
 658 descr:          CHINANET henan province network
 659 remarks:        Brute-force attack network
 660 drop:           yes
 661
 662 net:            154.89.5.0/24
 663 descr:          Agotoz HK Limited
 664 remarks:        Brute-force attack network
 665 drop:           yes
 666
 667 net:            185.156.72.0/24
 668 descr:          TOV VAIZ PARTNER / InterHost
 669 remarks:        Attack network tracing back to UA
 670 country:        UA
 671 drop:           yes
 672
 673 net:            185.196.220.0/24
 674 descr:          Makut Investments
 675 remarks:        Brute-force attack network
 676 drop:           yes
 677
 678 net:            193.201.9.0/24
 679 descr:          Infolink LLC
 680 remarks:        Based on domains ending up there, this network is entirely malicious
 681 drop:           yes
 682
 683 net:            195.133.20.0/24
 684 descr:          Tribeka Web Advisors S.A.
 685 remarks:        Tampers with RIR data, traces back to NL, not a safe place to route traffic to
 686 country:        NL
 687 drop:           yes
 688
 689 net:            194.135.24.0/24
 690 descr:          Tribeka Web Advisors S.A.
 691 remarks:        Tampers with RIR data, traces back to US, not a safe place to route traffic to
 692 country:        US
 693 drop:           yes
 694
 695 net:            196.11.32.0/20
 696 descr:          Sanlam Life Insurance Limited
 697 remarks:        Stolen AfriNIC IPv4 space announced from NL?
 698 country:        NL
 699 drop:           yes
 700
 701 net:            2a0e:b107:17fe::/47
 702 descr:          Amarai-Network - Location Test @ Antarctic
 703 remarks:        Tampers with RIR data, not a safe place to route traffic to
 704 drop:           yes
 705
 706 net:            2a0e:b107:d10::/44
 707 descr:          NZB.si Enterprises
 708 remarks:        Tampers with RIR data, not a safe place to route traffic to
 709 drop:           yes
 710
 711 net:            2a0f:7a80::/29
 712 descr:          ASLINE Limited
 713 remarks:        APNIC chunk owned by a HK-based IP hijacker, but assigned to DE
 714 country:        HK
 715 drop:           yes
 716
 717 net:            2a10:9700::/29
 718 descr:          1337TEAM LIMITED / eliteteam[.]to
 719 remarks:        Owned by an offshore letterbox company, suspected rogue ISP
 720 country:        RU
 721 drop:           yes