override-{a1,a3,other,xd}: Regular batch of various overrides

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>

diff --git a/overrides/override-a1.txt b/overrides/override-a1.txt
index 1ebf64591e4e517ec99e79c683c27537e2cb9a41..f56d3b62d6724e7b85398b33496fdb5f91eea182 100644 (file)
--- a/overrides/override-a1.txt
+++ b/overrides/override-a1.txt
@@ -25,7 +25,7 @@
 #
 
 aut-num:                       AS4224
-descr:                         The Calyx Institue
+name:                          The Calyx Institue
 remarks:                       Tor relay provider
 is-anonymous-proxy:            yes
 
@@ -152,7 +152,7 @@ remarks:                    Tor relay provider
 is-anonymous-proxy:            yes
 
 aut-num:                       AS62744
-descr:                         Quintex Alliance Consulting
+name:                          Quintex Alliance Consulting
 remarks:                       Tor relay provider
 is-anonymous-proxy:            yes
 
@@ -690,11 +690,6 @@ descr:                             Secure Internet Limited
 remarks:                       VPN provider
 is-anonymous-proxy:            yes
 
-net:                           45.231.206.0/23
-descr:                         SENTRIGLOBAL LTD
-remarks:                       VPN provider [high confidence, but not proofed]
-is-anonymous-proxy:            yes
-
 net:                           46.36.200.0/22
 descr:                         IAPS Security Services, L.L.C.
 remarks:                       VPN provider, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-networks/
@@ -1332,6 +1327,12 @@ descr:                           NordVPN
 remarks:                       VPN provider
 is-anonymous-proxy:            yes
 
+net:                           179.60.147.0/24
+descr:                         Cloud Solutions S.A.
+remarks:                       Attack network, rogue VPN operator?
+is-anonymous-proxy:            yes
+drop:                          yes
+
 net:                           179.61.220.0/24
 descr:                         GZ Systems Limited / PureVPN
 remarks:                       VPN provider

diff --git a/overrides/override-a3.txt b/overrides/override-a3.txt
index 2d607c8a6dbf9724859b8ca78e657f6002fea6c4..b36fbfe368950daa6e5b545f5a9286f72171eed7 100644 (file)
--- a/overrides/override-a3.txt
+++ b/overrides/override-a3.txt
@@ -1259,6 +1259,11 @@ descr:           HOSTERION SRL
 remarks:       Generic anycast network
 is-anycast:    yes
 
+net:           185.130.46.0/24
+descr:         Privex Inc.
+remarks:       Generic anycast network
+is-anycast:    yes
+
 net:           185.130.160.0/22
 descr:         mono solutions ApS
 remarks:       Generic anycast network

diff --git a/overrides/override-other.txt b/overrides/override-other.txt
index b0cef90bf80c021dad5a96f0062cbf986d2921d4..0d6abccee4b98d9e7bad5728c2aa64e21393d5d5 100644 (file)
--- a/overrides/override-other.txt
+++ b/overrides/override-other.txt
@@ -164,6 +164,11 @@ descr:             ZeXoTeK IT-Services GmbH
 remarks:       ISP located in DE, but some RIR data for announced prefixes contain garbage
 country:       DE
 
+aut-num:       AS8708
+name:          RCS & RDS SA
+remarks:       ISP located in RO, but some RIR data for announced prefixes contain garbage
+country:       RO
+
 aut-num:       AS9304
 descr:         HGC Global Communications Limited
 remarks:       Jurisdiction is HK, pinning the location there
@@ -239,11 +244,6 @@ descr:             Iranian Research Organization for Science & Technology
 remarks:       ISP located in IR, but some RIR data for announced prefixes contain garbage
 country:       IR
 
-aut-num:       AS15828
-descr:         Blue Diamond Network Co., Ltd.
-remarks:       Shady ISP, claims GB or IR for it's prefixes, but they all end up near Vilnius, LT
-country:       LT
-
 aut-num:       AS16262
 descr:         Datacheap Ltd.
 remarks:       ISP located in RU, but some RIR data for announced prefixes contain garbage
@@ -398,6 +398,11 @@ descr:             Virtual Systems LLC
 remarks:       ISP located in UA, but some RIR data for announced prefixes contain garbage
 country:       UA
 
+aut-num:       AS30938
+descr:         ahbr company limited
+remarks:       ... trackes back to GB
+country:       GB
+
 aut-num:       AS30982
 descr:         CAFE Informatique et telecommunications (defunct)
 remarks:       spamming bogon located in TG - formerly allocated to CAFE Informatique et telecommunications
@@ -608,6 +613,11 @@ descr:             Bunea TELECOM SRL
 remarks:       ISP located in RO, but some RIR data for announced prefixes contain garbage
 country:       RO
 
+aut-num:       AS42675
+descr:         Obehosting AB
+remarks:       ISP located in SE, but some RIR data for announced prefixes contain garbage
+country:       SE
+
 aut-num:       AS42745
 descr:         Safe Value Limited
 remarks:       tampers with RIR data, traces back to somewhere in central Europe
@@ -683,6 +693,11 @@ descr:             xTom GmbH
 remarks:       ISP located in JP, but some RIR data for announced prefixes contain garbage
 country:       JP
 
+aut-num:       AS43993
+descr:         IronTelecom OU
+remarks:       ISP located in RU, but some RIR data for announced prefixes contain garbage
+country:       RU
+
 aut-num:       AS44066
 descr:         diva-e Datacenters GmbH
 remarks:       ISP located in DE, but some RIR data for announced prefixes contain garbage
@@ -708,6 +723,11 @@ descr:             UAProstir Ltd.
 remarks:       ISP located in UA, but some RIR data for announced prefixes contain garbage
 country:       UA
 
+aut-num:       AS44676
+descr:         Perviy TSOD LLC
+remarks:       ISP located in RU, but some RIR data for announced prefixes contain garbage
+country:       RU
+
 aut-num:       AS44735
 descr:         Nova hf
 remarks:       ISP located in IS, but some RIR data for announced prefixes contain garbage
@@ -753,6 +773,11 @@ descr:             Quick Packet, LLC
 remarks:       ISP located in US, but some RIR data for announced prefixes contain garbage
 country:       US
 
+aut-num:       AS46573
+descr:         LayerHost
+remarks:       According to its website, this ISP hosts in US datacenters, pinning location
+country:       US
+
 aut-num:       AS46841
 descr:         Fork Networking, LLC
 remarks:       ISP located in US, but some RIR data for announced prefixes contain garbage
@@ -773,6 +798,11 @@ descr:             TOSE'EH ERTEBATAT NOVIN ARIA CO PJS
 remarks:       ISP located in IR, but some RIR data for announced prefixes contain garbage
 country:       IR
 
+aut-num:       AS47890
+descr:         UNMANAGED LTD
+remarks:       ISP located in RO, but some RIR data for announced prefixes contain garbage
+country:       RO
+
 aut-num:       AS48024
 descr:         NEROCLOUD Ltd.
 remarks:       RIR data faked/incorrect, cannot trust this network
@@ -808,11 +838,6 @@ descr:             LLC Baxet
 remarks:       tampers with RIR data, traces back to RU
 country:       RU
 
-aut-num:       AS49466
-descr:         KLAYER LLC
-remarks:       part of the "Asline" IP hijacking gang, traces back to AP region
-country:       AP
-
 aut-num:       AS49453
 descr:         Global Layer BV
 remarks:       ISP located in NL, but some RIR data for announced prefixes contain garbage
@@ -825,7 +850,7 @@ country:    RU
 
 aut-num:       AS49581
 descr:         Ferdinand Zink trading as Tube-Hosting
-remarks:       hosted at the Skylink DC in NL
+remarks:       According to https://tube-hosting.com/datacenter, this ISP hosts out of the SkyLink DC in NL
 country:       NL
 
 aut-num:       AS49612
@@ -833,11 +858,6 @@ descr:             DDoS Guard Ltd. / Cognitive Cloud LLP
 remarks:       another shady customer or branch of "DDoS Guard Ltd.", jurisdiction is probably RU, but traceroutes dead-end somewhere else in EU
 country:       EU
 
-aut-num:       AS49870
-descr:         Alsycon BV
-remarks:       Shady ISP located in NL, but some RIR data for announced prefixes contain garbage
-country:       NL
-
 aut-num:       AS49921
 descr:         F.I.H. FORMULA INVESTMENT HOUSE CLEARING LIMITED
 remarks:       claims GR for announced prefixes, but traceroutes dead-end somewhere else in EU
@@ -963,11 +983,21 @@ descr:            Cloud 9 Ltd.
 remarks:       ISP located in GE, but many RIR data for announced prefixes contain garbage
 country:       GE
 
+aut-num:       AS57818
+descr:         SKTV Ltd.
+remarks:       ISP located in RU, but many RIR data for announced prefixes contain garbage
+country:       RU
+
 aut-num:       AS57844
 descr:         SPDNet Telekomunikasyon Hizmetleri Bilgi Teknolojileri Taahhut Sanayi Ve Ticaret A.S.
 remarks:       ISP located in TR, but some RIR data for announced prefixes contain garbage
 country:       TR
 
+aut-num:       AS57866
+descr:         Fusix Network BV
+remarks:       ISP located in NL, but some RIR data for announced prefixes contain garbage
+country:       NL
+
 aut-num:       AS58057
 descr:         Securebit AG
 remarks:       ... who thinks messing with country codes galore is fun. We can do that, too, and pin their location to CH, since this at least is their accurate jurisdiction.
@@ -1037,6 +1067,11 @@ descr:           Leaseweb Asia Pacific pte. ltd.
 remarks:       ISP located in SG, but some RIR data for announced prefixes contain garbage
 country:       SG
 
+aut-num:       AS59432
+descr:         GINERNET S.L.
+remarks:       ISP located in ES, but some RIR data for announced prefixes contain garbage
+country:       ES
+
 aut-num:       AS59580
 descr:         Batterflyai Media Ltd.
 remarks:       ISP located in RU, but some RIR data for announced prefixes contain garbage
@@ -1197,6 +1232,11 @@ descr:           Leaseweb Asia Pacific pte. ltd.
 remarks:       ISP located in HK, some RIR data for announced prefixes contain garbage
 country:       HK
 
+aut-num:       AS133948
+descr:         DONGFONG INC LIMITED
+remarks:       ISP located in HK, some RIR data for announced prefixes contain default APNIC data
+country:       HK
+
 aut-num:       AS134121
 descr:         rainbow network limited
 remarks:       Shady ISP located somewhere in AP area (HK? TW? ???), RIR data contain garbage
@@ -1287,11 +1327,6 @@ descr:           Leaseweb Australia Pty. Ltd.
 remarks:       ISP located in AU, some RIR data for announced prefixes contain garbage
 country:       AU
 
-aut-num:       AS137443
-descr:         Anchnet Asia Limited
-remarks:       IP hijacker located in HK, tampers with RIR data
-country:       HK
-
 aut-num:       AS138195
 descr:         MOACK.Co.LTD
 remarks:       ISP located in KR, some RIR data for announced prefixes contain garbage
@@ -1363,9 +1398,9 @@ remarks:  Shady ISP located in HK
 country:       HK
 
 aut-num:       AS140224
-descr:         White-Sand Cloud Computing(HK) Co., LIMITED
-remarks:       part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to AP region
-country:       AP
+descr:         STARCLOUD GLOBAL PTE., LTD.
+remarks:       part of the "Asline" IP hijacking gang, tampers with RIR data, hosted in HK according to its website
+country:       HK
 
 aut-num:       AS140641
 descr:         YOTTA NETWORK SERVICES PRIVATE LIMITED
@@ -1402,6 +1437,11 @@ descr:           YISU CLOUD LTD
 remarks:       ... located in HK
 country:       HK
 
+aut-num:       AS142430
+descr:         DIGI VPS
+remarks:       ISP located in IN, but some RIR data for announced prefixes contain garbage
+country:       IN
+
 aut-num:       AS142578
 descr:         E-Large (HongKong)
 remarks:       traceroutes dead-end in US, and measurements could not proof that this AS is being located elsewhere
@@ -1482,6 +1522,11 @@ descr:           Luxoft Professional Romania S.R.L.
 remarks:       serivces hosted in RU
 country:       RU
 
+aut-num:       AS201814
+descr:         Meverywhere sp. z o.o.
+remarks:       According to its website, all datacenters of this ISP are located in PL
+country:       PL
+
 aut-num:       AS201912
 descr:         FutureNow Incorporated
 remarks:       ISP located in BG, but RIR data for announced prefixes contain garbage
@@ -1492,11 +1537,21 @@ descr:          SILVERHILL GROUP HOLDING LTD / SAKIS POLUNIGIS
 remarks:       fake offshore location (SC), traces back to RU
 country:       RU
 
+aut-num:       AS202914
+descr:         Adeo Datacenter ApS
+remarks:       According to its website, all datacenters used by this ISP are in DK
+country:       DK
+
 aut-num:       AS202505
 descr:         NETBUDUR TELEKOMUNIKASYON LIMITED SIRKETI
 remarks:       ISP located in TR, but some RIR data for announced prefixes contain garbage
 country:       TR
 
+aut-num:       AS203020
+descr:         HostRoyale Technologies Pvt Ltd
+remarks:       Pin the location of this AS to its jurisdiction (IN) due to massive tampering with RIR data
+country:       IN
+
 aut-num:       AS203038
 descr:         QuxLabs UG
 remarks:       traces back to SE
@@ -1532,6 +1587,11 @@ descr:           Rishikeshan Lavakumar
 remarks:       Network operator thinks messing with RIR data is funny... :-/
 country:       EU
 
+aut-num:       AS204687
+descr:         A2 Networks Inc.
+remarks:       ISP located in NL, but some RIR data for announced prefixes contain garbage
+country:       NL
+
 aut-num:       AS205026
 descr:         Hauer Hosting Services Limited
 remarks:       ISP located in ES, but some RIR data for announced prefixes contain garbage
@@ -1683,7 +1743,7 @@ remarks:  ISP located in RU, but some RIR data for announced prefixes contain gar
 country:       RU
 
 aut-num:       AS210644
-descr:         Des Capital B.V.
+descr:         AEZA GROUP Ltd
 remarks:       ISP located in RU, but some RIR data for announced prefixes contain garbage
 country:       RU
 
@@ -1692,6 +1752,11 @@ descr:           Des Capital B.V.
 remarks:       Shady ISP located in NL, but RIR data for announced prefixes contain garbage
 country:       NL
 
+aut-num:       AS210718
+descr:         FIVE CYBER HOST SECURITY S.R.L.
+remarks:       ISP located in RO, but RIR data for announced prefixes contain garbage
+country:       RO
+
 aut-num:       AS211237
 descr:         FORTR TELEKOMUNIKASYON SANAYI VE TICARET LIMITED SIRKETI
 remarks:       ISP located in TR, but some RIR data for announced prefixes contain garbage
@@ -1842,14 +1907,19 @@ descr:          Wirels Connect (PTY) Ltd
 remarks:        AS being announced out of PT
 country:        PT
 
+aut-num:       AS328227
+descr:         Xhostserver LLC
+remarks:       ISP located in ZA, many RIR data for announced prefixes contain garbage
+country:       ZA
+
 aut-num:       AS328383
 descr:         xTom Limited
 remarks:       ISP located in ZA, RIR data for announced prefixes contain garbage
 country:       ZA
 
-aut-num:       AS328227
-descr:         Xhostserver LLC
-remarks:       ISP located in ZA, many RIR data for announced prefixes contain garbage
+aut-num:       AS328703
+descr:         Seven Network Inc.
+remarks:       ISP located in ZA, RIR data for announced prefixes contain garbage
 country:       ZA
 
 aut-num:       AS328608
@@ -1932,6 +2002,11 @@ descr:           Tcloudnet
 remarks:       Part of the "ASLINE" IP hijacking gang, HK vicinity seems to be part of US too for them :-/
 country:       AP
 
+aut-num:       AS399641
+descr:         Wolverine Trading, LLC
+remarks:       ISP located in US, many RIR data for announced prefixes contain garbage
+country:       US
+
 aut-num:       AS400039
 descr:         Wolverine Trading, LLC
 remarks:       IP hijacker located in US, tampers with RIR data
@@ -2252,6 +2327,11 @@ descr:           Intelcom Group Ltd
 remarks:       fake offshore location (SC), traces back to RU
 country:       RU
 
+net:           185.105.0.0/22
+descr:         G-Core Innovations S.a r.l.
+remarks:       this network does not appear to have any relations to IN whatsoever, it is rather used out of central Europe (LU?)
+country:       LU
+
 net:           185.140.204.0/22
 descr:         Hornetsecurity GmbH
 remarks:       all suballocations are used in DE, but are assigned to US

diff --git a/overrides/override-xd.txt b/overrides/override-xd.txt
index 4c3312a7f83c90574a3bfda0983ac47a3b56a2e5..3f3c46f8f3be0b54c1e5c17d8edbc7c7b66a669d 100644 (file)
--- a/overrides/override-xd.txt
+++ b/overrides/override-xd.txt
@@ -26,10 +26,15 @@
 # Please keep this file sorted.
 #
 
+aut-num:       AS15828
+descr:         Blue Diamond Network Co., Ltd.
+remarks:       Shady ISP hosting brute-force login attempt machines galore, claims GB or IR for it's prefixes, but they all end up near Vilnius, LT
+country:       LT
+drop:          yes
+
 aut-num:       AS18254
 descr:         KLAYER LLC
-remarks:       part of the "Asline" IP hijacking gang, traces back to AP region
-country:       AP
+remarks:       part of the "Asline" IP hijacking gang
 drop:          yes
 
 aut-num:       AS18013
@@ -38,12 +43,6 @@ remarks:     IP hijacker, traces back to HK
 country:       HK
 drop:          yes
 
-aut-num:       AS22769
-descr:         DDOSING NETWORK
-remarks:       IP hijacker located in US, massively tampers with RIR data
-country:       US
-drop:          yes
-
 aut-num:       AS24567
 descr:         QT Inc.
 remarks:       IP hijacker operating out of AP area (HK or TW?)
@@ -55,10 +54,15 @@ descr:              1337TEAM LIMITED / eliteteam[.]to
 remarks:       Bulletproof ISP
 drop:          yes
 
+aut-num:       AS40193
+descr:         Trit Networks, LLC
+remarks:       all cybercrime hosting, all the time
+country:       US
+drop:          yes
+
 aut-num:       AS41564
 descr:         Orion Network Limited
-remarks:       shady uplink for a bunch of dirty ISPs in SE (and likely elsewhere in EU), routing stolen AfriNIC networks, RIR data of prefixes announced by this AS cannot be trusted
-country:       EU
+remarks:       shady uplink for a bunch of dirty ISPs, routing stolen AfriNIC networks
 drop:          yes
 
 aut-num:       AS41909
@@ -99,8 +103,19 @@ drop:               yes
 
 aut-num:       AS49447
 descr:         Nice IT Services Group Inc.
-remarks:       Rogue ISP located in CH, but some RIR data for announced prefixes contain garbage
-country:       CH
+remarks:       Rogue ISP
+drop:          yes
+
+aut-num:       AS49870
+descr:         Alsycon BV
+remarks:       Shady ISP (related to AS204655 et al., same postal address) located in NL, but some RIR data for announced prefixes contain garbage
+country:       NL
+drop:          yes
+
+aut-num:       AS49466
+descr:         KLAYER LLC
+remarks:       part of the "Asline" IP hijacking gang, traces back to San Jose, CR
+country:       CR
 drop:          yes
 
 aut-num:       AS49943
@@ -138,6 +153,12 @@ remarks:   part of the "Asline" IP hijacking gang, tampers with RIR data, traces b
 country:       HK
 drop:          yes
 
+aut-num:       AS57509
+descr:         L&L Investment Ltd.
+remarks:       another shady customer of "Tamatiya EOOD / 4Vendeta"
+country:       BG
+drop:          yes
+
 aut-num:       AS56447
 descr:         511 Far East Limited
 remarks:       IP hijacker, tampers with RIR data
@@ -215,11 +236,13 @@ drop:             yes
 aut-num:       AS60930
 descr:         Intem LLC
 remarks:       leaf AS with upstream to other dirty hosters, brute-force attacks galore
+country:       RU
 drop:          yes
 
 aut-num:       AS61414
 descr:         EDGENAP LTD
-remarks:       IP hijacking? Rogue ISP?
+remarks:       part of the "Asline" IP hijacking gang, the majority of announced prefixes trace back to JP
+country:       JP
 drop:          yes
 
 aut-num:       AS61432
@@ -263,6 +286,12 @@ remarks:   IP hijacker located in HK, suspected to be part of the "Asline" IP hija
 country:       HK
 drop:          yes
 
+aut-num:       AS137443
+descr:         Anchnet Asia Limited
+remarks:       IP hijacker located in HK, tampers with RIR data
+country:       HK
+drop:          yes
+
 aut-num:       AS137523
 descr:         HONGKONG CLOUD NETWORK TECHNOLOGY CO., LIMITED
 remarks:       ISP and IP hijacker located in HK, tampers with RIR data
@@ -358,6 +387,11 @@ remarks:   bulletproof ISP and IP hijacker, related to AS202425 and AS62355, trace
 country:       NL
 drop:          yes
 
+aut-num:       AS203680
+descr:         Southern Production and Technical Enterprise Ltd.
+remarks:       Hijacked?
+drop:          yes
+
 aut-num:       AS204341
 descr:         Purple Raccoon Ltd.
 remarks:       Bulletproof ISP in an extremely dirty neighborhood full of IP hijackers
@@ -394,6 +428,12 @@ remarks:   bulletproof ISP, see: https://krebsonsecurity.com/2019/07/meet-the-worl
 country:       RU
 drop:          yes
 
+aut-num:       AS207566
+descr:         Chang Way Technologies Co. Limited
+remarks:       Rogue ISP
+country:       RU
+drop:          yes
+
 aut-num:       AS209160
 descr:         Miti 2000 EOOD
 remarks:       another shady customer of "Tamatiya EOOD / 4Vendeta", located in BG, tampers with RIR data
@@ -418,6 +458,11 @@ remarks:   Shary Serverion customer and IP hijacker in NL, many RIR data for annou
 country:       NL
 drop:          yes
 
+aut-num:       AS210352
+descr:         Partner LLC
+remarks:       All cybercrime hosting, all the time
+drop:          yes
+
 aut-num:       AS210644
 descr:         AEZA GROUP Ltd
 remarks:       In all networks currently propagated by this AS, one is unable to find anything that has even a patina of legitimacy
@@ -454,6 +499,12 @@ remarks:   Dirty ISP located somewhere in EU, cannot trust RIR data of this networ
 country:       EU
 drop:          yes
 
+aut-num:       AS213010
+descr:         GigaHostingServices OU
+remarks:       Does not appear to host any legitimate infrastructure whatsoever, just mass brute-force login attempts
+country:       PL
+drop:          yes
+
 aut-num:       AS213058
 descr:         Private Internet Hosting LTD
 remarks:       bulletproof ISP located in RU
@@ -519,11 +570,34 @@ descr:            Black Apple
 remarks:       Solely announces hijacked prefixes, no legitimate infrastructure
 drop:          yes
 
+net:           45.143.203.0/24
+descr:         TOV VAIZ PARTNER
+remarks:       Attack network tracing back to NL
+country:       NL
+drop:          yes
+
 net:           46.161.27.0/24
 descr:         MEGA HOLDINGS LIMITED
 remarks:       Based on domains ending up there, this network is entirely malicious
 drop:          yes
 
+net:           91.240.243.0/24
+descr:         Media Land LLC
+remarks:       bulletproof ISP, see: https://krebsonsecurity.com/2019/07/meet-the-worlds-biggest-bulletproof-hoster/
+drop:          yes
+
+net:           92.63.196.0/24
+descr:         TOV VAIZ PARTNER / Perfect Hosting Solutions
+remarks:       Attack network tracing back to NL
+country:       NL
+drop:          yes
+
+net:           185.156.72.0/24
+descr:         TOV VAIZ PARTNER / InterHost
+remarks:       Attack network tracing back to UA
+country:       UA
+drop:          yes
+
 net:           185.196.220.0/24
 descr:         Makut Investments
 remarks:       Long-running brute-force attack network