override-{a[1, 3}, other}: add overrides for Akamai and some AP-based IP hijackers

Those came to my attention last night... These two "Cloud Innovation
Ltd." networks are especially interesting, since they strongly suggest
to be hijacked or stolen from AFRINIC for the sole purpose to be routed
by various dirty networks worldwide. Some of them host a decent amount
of phishing and C&Cs, while others seem to be used as proxy
infrastructure by miscreants, which is why an A1 flag seems to be
justified from my point of view.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/overrides/override-a1.txt b/overrides/override-a1.txt
index a0a440465618d17fcbbb811405f33a56807af28f..b1fa1b3590eb242357b876b5dee4e8054d53154c 100644 (file)
--- a/overrides/override-a1.txt
+++ b/overrides/override-a1.txt
@@ -406,6 +406,11 @@ descr:                             Express VPN International Ltd
 remarks:                       VPN provider
 is-anonymous-proxy:    yes
 
+net:                           45.192.0.0/12
+descr:                         Cloud Innovation Ltd.
+remarks:                       hijacked AFRINIC IP chunk owned by an offshore company, routed to several dirty networks worldwide, cannot tell what is going on here
+is-anonymous-proxy:    yes
+
 net:                           45.220.72.0/22
 descr:                         Low budget VPN service
 remarks:                       VPN provider
@@ -611,6 +616,11 @@ descr:                             CloudMine NET
 remarks:                       VPN provider [high confidence, but not proofed]
 is-anonymous-proxy:    yes
 
+net:                           92.118.204.0/22
+descr:                         Mo's Operations GmbH
+remarks:                       VPN provider [high confidence, but not proofed]
+is-anonymous-proxy:    yes
+
 net:                           94.199.160.0/23
 descr:                         MIK Telecom VPN pool
 remarks:                       VPN provider
@@ -801,6 +811,11 @@ descr:                             WIFI and PROXY NET / Atlantique Telecom
 remarks:                       VPN provider [high confidence, but not proofed]
 is-anonymous-proxy:    yes
 
+net:                           154.192.0.0/11
+descr:                         Cloud Innovation Ltd.
+remarks:                       hijacked AFRINIC IP chunk, owned by suspicous offshore company, scattered across dirty networks worldwide - not a safe place to go
+is-anonymous-proxy:    yes
+
 net:                           161.129.60.0/24
 descr:                         10VPN Hosting
 remarks:                       VPN provider
@@ -1173,6 +1188,11 @@ descr:                           LogicWeb Inc. / BGRVPN / Private Internet Access / VPNetworks / Cookie
 remarks:                       large IP chunk mostly used by VPN providers
 is-anonymous-proxy:    yes
 
+net:                           196.61.192.0/20
+descr:                         Inspiring Networks LTD
+remarks:                       hijacked (?) IP network owned by an offshore company [high confidence, but not proofed]
+is-anonymous-proxy:    yes
+
 net:                           197.221.161.0/24
 descr:                         VPNClientPublics
 remarks:                       VPN provider
@@ -1201,6 +1221,7 @@ is-anonymous-proxy:       yes
 net:                           202.9.16.0/20
 descr:                         VPNsolutions Pty Ltd
 remarks:                       VPN provider
+
 is-anonymous-proxy:    yes
 
 net:                           202.152.146.0/24

diff --git a/overrides/override-a3.txt b/overrides/override-a3.txt
index 07b26215d3b8c9341fb54bc3242b6dbf8da63c29..1112e6dc5050d9396c37fc25348b4f3343698743 100644 (file)
--- a/overrides/override-a3.txt
+++ b/overrides/override-a3.txt
@@ -25,6 +25,16 @@ descr:               DirectNIC, Ltd.
 remarks:       Generic anycast network [high confidence, but not proofed]
 is-anycast:    yes
 
+aut-num:       AS16625
+descr:         Akamai Technologies, Inc.
+remarks:       Worldwide CDN, does not make sense to assign their networks to a specific country
+is-anycast:    yes
+
+aut-num:       AS20940
+descr:         Akamai International BV
+remarks:       Worldwide CDN, does not make sense to assign their networks to a specific country 
+is-anycast:    yes
+
 aut-num:       AS31529
 descr:         DENIC eG
 remarks:       TLD operator's anycast network

diff --git a/overrides/override-other.txt b/overrides/override-other.txt
index fb60d97c8ea17e337b7435ce604b67d5a7faf4c5..09d87fc5411e764643509a371444110eeda0e664 100644 (file)
--- a/overrides/override-other.txt
+++ b/overrides/override-other.txt
@@ -38,6 +38,16 @@ descr:               KLAYER LLC
 remarks:       part of the "Asline" IP hijacking gang, traces back to AP region
 country:       AP
 
+aut-num:       AS22769
+descr:         DDOSING NETWORK
+remarks:       IP hijacker located somewhere in AP, massively tampers with RIR data
+country:       AP
+
+aut-num:       AS24009
+descr:         HK UNITE TELECOMMUNICATIONS DEVELOPMENT LIMITED
+remarks:       IP hijacker (?) located in HK, tampers with RIR data
+country:       HK
+
 aut-num:       AS24700
 descr:         Yes Networks Unlimited Ltd
 remarks:       traces to UA, but some RIR entries seem to contain garbage (VG)
@@ -53,6 +63,11 @@ descr:               IP Interactive UG (haftungsbeschraenkt)
 remarks:       ISP located in BG, but RIR data for announced prefixes contain garbage
 country:       BG
 
+aut-num:       AS35251
+descr:         NetLab
+remarks:       tampers with RIR data, most probabyl located in HK
+country:       HK
+
 aut-num:       AS35478
 descr:         Buena Telecom SRL
 remarks:       ISP located in RO, but RIR data for announced prefixes contain garbage
@@ -138,11 +153,21 @@ descr:            Network Dedicated SAS
 remarks:       bulletproof ISP, claims to be located in CH, but traces to NL
 country:       NL
 
+aut-num:       AS62468
+descr:         VpsQuan L.L.C.
+remarks:       claims to be located in US, but traces to HK
+country:       HK
+
 aut-num:       AS134548
 descr:         DXTL Tseung Kwan O Service
 remarks:       tampers with RIR data, traces back to AP region
 country:       AP
 
+aut-num:       AS137443
+descr:         Anchnet Asia Limited
+remarks:       IP hijacker located in HK, tampers with RIR data
+country:       HK
+
 aut-num:       AS137951
 descr:         Clayer Limited
 remarks:       part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to AP region
@@ -233,6 +258,16 @@ descr:             FlokiNET Ltd.
 remarks:       fake offshore location (SC), traces back to RO
 country:       RO
 
+net:           45.93.16.0/22
+descr:         IPv4 Superhub Limited
+remarks:       network owned by an HK company, traces back to HK as well - but is assigned to DE. Nice try...
+country:       HK
+
+net:           45.134.144.0/22
+descr:         IPv4 Superhub Limited
+remarks:       same as 45.93.16.0/22
+country:       HK
+
 net:           45.145.36.0/22
 descr:         GlobalCache Technology CO., Ltd.
 remarks:       claims to be located in DE, but traces back to HK