override-{a1,a3,other,xd}: Regular batch of various overrides

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>

diff --git a/overrides/override-a1.txt b/overrides/override-a1.txt
index 47cdfbefee99463adca342c437688520cab6f461..5946c02296886d21582a3240100b787cbb21e3b2 100644 (file)
--- a/overrides/override-a1.txt
+++ b/overrides/override-a1.txt
@@ -76,6 +76,11 @@ descr:                               Asiamax Ltd. VPN
 remarks:                       VPN provider
 is-anonymous-proxy:            yes
 
+aut-num:                       AS44570
+descr:                         Cloudie Networks, LLC.
+remarks:                       VPN provider / IPv6 tunnel broker service
+is-anonymous-proxy:            yes
+
 aut-num:                       AS44571
 descr:                         Netvillage Ltd.
 remarks:                       VPN provider [high confidence, but not proofed] located in or near RU
@@ -181,6 +186,11 @@ descr:                             MyTelco Ltd
 remarks:                       VPN provider [high confidence, but not proofed]
 is-anonymous-proxy:            yes
 
+aut-num:                       AS204789
+descr:                         BizbetaLTD
+remarks:                       VPN provider [high confidence, but not proofed]
+is-anonymous-proxy:            yes
+
 aut-num:                       AS205016
 descr:                         HERN Labs AB
 remarks:                       VPN provider [high confidence, but not proofed]

diff --git a/overrides/override-a3.txt b/overrides/override-a3.txt
index 9e7c4d8f10977651f841bb6c88743dad29bf59d5..c3ed219131eac87c990e63f743097a6a6969598d 100644 (file)
--- a/overrides/override-a3.txt
+++ b/overrides/override-a3.txt
@@ -105,6 +105,12 @@ descr:             Vitalwerks Internet Solutions, LLC
 remarks:       Public anycast DNS resolver network [high confidence, but not proofed]
 is-anycast:    yes
 
+aut-num:       AS30456
+descr:         Cosmic Global Networks
+remarks:       Worldwide (?) CDN, does not make sense to assign their networks to a specific country, attempt to fix bogus RIR data anyways
+is-anycast:    yes
+country:       US
+
 aut-num:       AS31529
 descr:         DENIC eG
 remarks:       TLD operator's anycast network
@@ -343,6 +349,11 @@ descr:             CentralNic Ltd
 remarks:       Generic anycast network
 is-anycast:    yes
 
+aut-num:       AS204914
+descr:         LABIXE LTD
+remarks:       Upstreams are CDNs and alike services, possibly used in an anycast-like manner
+is-anycast:    yes
+
 aut-num:       AS205157
 descr:         Daniel Cid
 remarks:       Generic anycast network [high confidence, but not proofed]

diff --git a/overrides/override-other.txt b/overrides/override-other.txt
index 7fc4445e21251cfb1baf9a77755c808c1d95cfb7..bd49e6915870e4e38d29f47b0fd5d0c70c7c4a34 100644 (file)
--- a/overrides/override-other.txt
+++ b/overrides/override-other.txt
@@ -32,6 +32,11 @@ descr:               Jisc Services Limited
 remarks:       ISP located in GB, but some RIR data for announced prefixes contain garbage
 country:       GB
 
+aut-num:       AS979
+descr:         NetLab Global
+remarks:       ISP located in US, but some RIR data for announced prefixes contain garbage
+country:       US
+
 aut-num:       AS1653
 descr:         SUNET Swedish University Network
 remarks:       ISP located in SE, but some RIR data for announced prefixes contain garbage
@@ -259,6 +264,11 @@ descr:             Datacheap Ltd.
 remarks:       ISP located in RU, but some RIR data for announced prefixes contain garbage
 country:       RU
 
+aut-num:       AS17048
+descr:         Awknet Communications, LLC
+remarks:       ISP located in US, but some RIR data for announced prefixes contain garbage
+country:       US
+
 aut-num:       AS17447
 descr:         Net4India Ltd
 remarks:       Serverion customer in NL, many RIR data for announced prefixes contain garbage
@@ -313,6 +323,11 @@ descr:             ReliableSite.Net LLC
 remarks:       ISP located in US, but RIR data for announced prefixes contain garbage
 country:       US
 
+aut-num:       AS23679
+descr:         Media Antar Nusa PT.
+remarks:       ISP and IP hijacker located in ID, but RIR data for announced prefixes contain garbage
+country:       ID
+
 aut-num:       AS23858
 descr:         xTom Pty. Ltd.
 remarks:       ISP located in AU, RIR data for announced prefixes contain garbage
@@ -483,11 +498,6 @@ descr:             Institute for Research in Fundamental Sciences
 remarks:       ISP located in IR, but some RIR data for announced prefixes contain garbage
 country:       IR
 
-aut-num:       AS58057
-descr:         iFog GmbH
-remarks:       location pinning to CH due to massive RIR data tampering
-country:       CH
-
 aut-num:       AS34933
 descr:         PP Aleksandr Tatarets
 remarks:       ... hosted out of DE
@@ -953,8 +963,13 @@ descr:             DataClub S.A.
 remarks:       location pinning to LV
 country:       LV
 
+aut-num:       AS52302
+descr:         Awknet International, S.A.
+remarks:       ISP located in US, but some RIR data for announced prefixes contain garbage
+country:       US
+
 aut-num:       AS52423
-descr:         Data Miners S.A. ( Racknation.cr )
+descr:         Data Miners S.A.
 remarks:       ISP located in CR, but some RIR data for announced prefixes contain garbage
 country:       CR
 
@@ -1492,6 +1507,11 @@ descr:           E-Large (HongKong)
 remarks:       traceroutes dead-end in US, and measurements could not proof that this AS is being located elsewhere
 country:       US
 
+aut-num:       AS14445
+descr:         PeaceWeb
+remarks:       According to its website, this ISP is active in US and GB - no IP networks allocated to the latter, however, but many tamper with RIR data. Pin this AS to US to protect our users.
+country:       US
+
 aut-num:       AS196682
 descr:         FLP Kochenov Aleksej Vladislavovich
 remarks:       ISP located in UA, but RIR data for announced prefixes all say EU
@@ -1632,6 +1652,11 @@ descr:           Rishikeshan Lavakumar
 remarks:       Network operator thinks messing with RIR data is funny... :-/
 country:       EU
 
+aut-num:       AS206446
+descr:         Evgeni Barabash trading as Active Cloud
+remarks:       ISP located in IL, but some RIR data for announced prefixes contain garbage
+country:       IL
+
 aut-num:       AS204687
 descr:         A2 Networks Inc.
 remarks:       ISP located in NL, but some RIR data for announced prefixes contain garbage
@@ -2237,6 +2262,11 @@ descr:           Petersburg Internet Network Ltd.
 remarks:       RIR data for suballocations contain garbage, they are all located in RU
 country:       RU
 
+net:           92.119.56.0/24
+descr:         Negah Roshan Pars Company (PJS)
+remarks:       fake location (DE), traces back to NL
+country:       NL
+
 net:           92.223.90.0/24
 descr:         G-Core Labs S.A.
 remarks:       fake location (CY), traces back to HK

diff --git a/overrides/override-xd.txt b/overrides/override-xd.txt
index 595d4ca7b68bca06f92adb867736b5b92786627b..08217ed307be9a08464fd5aad418b3549abd879b 100644 (file)
--- a/overrides/override-xd.txt
+++ b/overrides/override-xd.txt
@@ -570,11 +570,6 @@ remarks:   Attack network tracing back to NL
 country:       NL
 drop:          yes
 
-net:           46.161.27.0/24
-descr:         MEGA HOLDINGS LIMITED
-remarks:       Based on domains ending up there, this network is entirely malicious
-drop:          yes
-
 net:           61.177.172.0/23
 descr:         CHINANET jiangsu province network
 remarks:       Since July 27, 2022, this network conducts mass brute-force attacks galore