overrides/override-xd.txt

   1 #
   2 # override-xd [.txt]
   3 #
   4 # This file contains Autonomous Systems and IP networks strongly believed or proofed to be hostile,
   5 # posing a _technical_ threat against libloc users in general and/or IPFire users in particular.
   6 #
   7 # libloc neither was intended to be an "opinionated" database, nor should it become that way. Please
   8 # refer to commit 69b3d894fbee6e94afc2a79593f7f6b300b88c10 for the rationale of implementing a special
   9 # flag for hostile networks.
  10 #
  11 # Technical threats cover publicly routable network infrastructure solely dedicated or massively abused to
  12 # host phishing, malware, C&C servers, non-benign vulnerability scanners, or being used as a "bulletproof"
  13 # hosting space for cybercrime infrastructure.
  14 #
  15 # This file should not contain short-lived threats being hosted within legitimate infrastructures, as
  16 # libloc it neither intended nor suitable to protect against such threats in a timely manner - by default,
  17 # clients download a new database once a week.
  18 #
  19 # Networks posing non-technical threats - i. e. not covered by the definition above - must not be listed
  20 # here.
  21 #
  22 # Improvement suggestions are appreciated, please submit them as patches to the location mailing
  23 # list. Refer to https://lists.ipfire.org/mailman/listinfo/location and https://wiki.ipfire.org/devel/contact
  24 # for further information.
  25 #
  26 # Please keep this file sorted.
  27 #
  28
  29 aut-num:        AS18254
  30 descr:          KLAYER LLC
  31 remarks:        part of the "Asline" IP hijacking gang, traces back to AP region
  32 country:        AP
  33 drop:           yes
  34
  35 aut-num:        AS18013
  36 descr:          ASLINE LIMITED
  37 remarks:        IP hijacker, traces back to HK
  38 country:        HK
  39 drop:           yes
  40
  41 aut-num:        AS22769
  42 descr:          DDOSING NETWORK
  43 remarks:        IP hijacker located in US, massively tampers with RIR data
  44 country:        US
  45 drop:           yes
  46
  47 aut-num:        AS24567
  48 descr:          QT Inc.
  49 remarks:        IP hijacker operating out of AP area (HK or TW?)
  50 country:        AP
  51 drop:           yes
  52
  53 aut-num:        AS39770
  54 descr:          1337TEAM LIMITED / eliteteam[.]to
  55 remarks:        Owned by an offshore letterbox company, suspected rogue ISP
  56 drop:           yes
  57
  58 aut-num:        AS41564
  59 descr:          Orion Network Limited
  60 remarks:        shady uplink for a bunch of dirty ISPs in SE (and likely elsewhere in EU), routing stolen AfriNIC networks, RIR data of prefixes announced by this AS cannot be trusted
  61 country:        EU
  62 drop:           yes
  63
  64 aut-num:        AS43092
  65 descr:          Kirin Communication Limited
  66 remarks:        Hijacks IP space and tampers with RIR data, traces back to JP
  67 country:        JP
  68 drop:           yes
  69
  70 aut-num:        AS44015
  71 descr:          Landgard Management Inc.
  72 remarks:        bulletproof ISP with strong links to RU
  73 country:        RU
  74 drop:           yes
  75
  76 aut-num:        AS44446
  77 descr:          OOO SibirInvest
  78 remarks:        bulletproof ISP (related to AS202425 and AS57717) located in NL
  79 country:        NL
  80 drop:           yes
  81
  82 aut-num:        AS47154
  83 descr:          HUSAM A. H. HIJAZI
  84 remarks:        Rogue ISP located in NL
  85 country:        NL
  86 drop:           yes
  87
  88 aut-num:        AS48090
  89 descr:          PPTECHNOLOGY LIMITED
  90 remarks:        bulletproof ISP (related to AS204655) located in NL
  91 country:        NL
  92 drop:           yes
  93
  94 aut-num:        AS49447
  95 descr:          Nice IT Services Group Inc.
  96 remarks:        Rogue ISP located in CH, but some RIR data for announced prefixes contain garbage
  97 country:        CH
  98 drop:           yes
  99
 100 aut-num:        AS51381
 101 descr:          1337TEAM LIMITED / eliteteam[.]to
 102 remarks:        Owned by an offshore letterbox company, suspected rogue ISP
 103 country:        RU
 104 drop:           yes
 105
 106 aut-num:        AS54600
 107 descr:          PEG TECH INC
 108 remarks:        ISP and IP hijacker located in US this time, tampers with RIR data
 109 country:        US
 110 drop:           yes
 111
 112 aut-num:        AS55020
 113 descr:          Aodao Inc
 114 remarks:        part of the "Asline" IP hijacking gang (?), tampers with RIR data, traces back to HK
 115 country:        HK
 116 drop:           yes
 117
 118 aut-num:        AS55303
 119 descr:          Eagle Sky Co., Lt[d ?]
 120 remarks:        Autonomous System registered to offshore company, abuse contact is a freemail address, address says "0 Market Square, P.O. Box 364, Belize", seems to trace to some location in AP vicinity
 121 country:        AP
 122 drop:           yes
 123
 124 aut-num:        AS55933
 125 descr:          Cloudie Limited
 126 remarks:        part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to HK
 127 country:        HK
 128 drop:           yes
 129
 130 aut-num:        AS56447
 131 descr:          511 Far East Limited
 132 remarks:        IP hijacker, tampers with RIR data
 133 country:        RU
 134 drop:           yes
 135
 136 aut-num:        AS56611
 137 descr:          REBA Communications BV
 138 remarks:        bulletproof ISP (related to AS202425) located in NL
 139 country:        NL
 140 drop:           yes
 141
 142 aut-num:        AS56873
 143 descr:          1337TEAM LIMITED / eliteteam[.]to
 144 remarks:        Owned by an offshore letterbox company, suspected rogue ISP
 145 drop:           yes
 146
 147 aut-num:        AS57523
 148 descr:          Chang Way Technologies Co. Limited
 149 remarks:        bulletproof ISP, C&C server hosting galore
 150 drop:           yes
 151
 152 aut-num:        AS57717
 153 descr:          FiberXpress BV
 154 remarks:        bulletproof ISP (related to AS202425) located in NL
 155 country:        NL
 156 drop:           yes
 157
 158 aut-num:        AS57858
 159 descr:          Inter Connects Inc.
 160 remarks:        part of a dirty ISP conglomerate operating most likely out of SE, hijacking stolen AfriNIC networks, massively tampers with RIR data
 161 country:        SE
 162 drop:           yes
 163
 164 aut-num:        AS57972
 165 descr:          Inter Connects Inc.
 166 remarks:        part of a dirty ISP conglomerate operating most likely out of SE, hijacking stolen AfriNIC networks, massively tampers with RIR data
 167 country:        SE
 168 drop:           yes
 169
 170 aut-num:        AS58271
 171 descr:          FOP Gubina Lubov Petrivna
 172 remarks:        bulletproof ISP operating from a war zone in eastern UA
 173 country:        UA
 174 drop:           yes
 175
 176 aut-num:        AS58810
 177 descr:          iZus Co., Ltd
 178 remarks:        Autonomous System registered to offshore company, abuse contact is a freemail address, seems to trace to some location in AP vicinity
 179 country:        AP
 180 drop:           yes
 181
 182 aut-num:        AS59753
 183 descr:          Vault Dweller OU
 184 remarks:        bulletproof ISP (related to AS57717) located in NL
 185 country:        NL
 186 drop:           yes
 187
 188 aut-num:        AS60424
 189 descr:          1337TEAM LIMITED / eliteteam[.]to
 190 remarks:        Owned by an offshore letterbox company, suspected rogue ISP
 191 drop:           yes
 192
 193 aut-num:        AS60485
 194 descr:          Inter Connects Inc. / Jing Yun
 195 remarks:        part of a dirty ISP conglomerate operating most likely out of SE, hijacking AfriNIC networks
 196 country:        SE
 197 drop:           yes
 198
 199 aut-num:        AS60930
 200 descr:          Intem LLC
 201 remarks:        leaf AS with upstream to other dirty hosters, brute-force attacks galore
 202 drop:           yes
 203
 204 aut-num:        AS61414
 205 descr:          EDGENAP LTD
 206 remarks:        IP hijacking? Rogue ISP?
 207 drop:           yes
 208
 209 aut-num:        AS62068
 210 descr:          SpectraIP B.V.
 211 remarks:        bulletproof ISP (linked to AS202425 et al.) located in NL
 212 country:        NL
 213 drop:           yes
 214
 215 aut-num:        AS64425
 216 descr:          SKB Enterprise B.V.
 217 remarks:        bulletproof ISP (linked to AS202425 et al.) located in NL
 218 country:        NL
 219 drop:           yes
 220
 221 aut-num:        AS133201
 222 descr:          ABCDE GROUP COMPANY LIMITED
 223 remarks:        ISP and/or IP hijacker located in HK
 224 country:        HK
 225 drop:           yes
 226
 227 aut-num:        AS135097
 228 descr:          LUOGELANG (FRANCE) LIMITED
 229 remarks:        Shady ISP located in HK, RIR data for announced prefixes contain garbage, solely announcing "Cloud Innovation Ltd." space - no one will miss it
 230 country:        HK
 231 drop:           yes
 232
 233 aut-num:        AS136545
 234 descr:          Blue Data Center
 235 remarks:        IP hijacker located somewhere in AP area, tampers with RIR data
 236 country:        AP
 237 drop:           yes
 238
 239 aut-num:        AS136800
 240 descr:          ICIDC NETWORK
 241 remarks:        IP hijacker located in HK, suspected to be part of the "Asline" IP hijacking gang, tampers with RIR data
 242 country:        HK
 243 drop:           yes
 244
 245 aut-num:        AS137523
 246 descr:          HONGKONG CLOUD NETWORK TECHNOLOGY CO., LIMITED
 247 remarks:        ISP and IP hijacker located in HK, tampers with RIR data
 248 country:        HK
 249 drop:           yes
 250
 251 aut-num:        AS137951
 252 descr:          Clayer Limited
 253 remarks:        part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to HK
 254 country:        HK
 255 drop:           yes
 256
 257 aut-num:        AS138648
 258 descr:          ASLINE Global Exchange
 259 remarks:        IP hijacker located somewhere in AP area
 260 country:        AP
 261 drop:           yes
 262
 263 aut-num:        AS139330
 264 descr:          SANREN DATA LIMITED
 265 remarks:        IP hijacker located somewhere in AP region, tampers with RIR data
 266 country:        AP
 267 drop:           yes
 268
 269 aut-num:        AS140107
 270 descr:          CITIS CLOUD GROUP LIMITED
 271 remarks:        part of the "Asline" IP hijacking gang, tampers with RIR data
 272 country:        AP
 273 drop:           yes
 274
 275 aut-num:        AS141159
 276 descr:          Incomparable(HK)Network Co., Limited
 277 remarks:        ISP and IP hijacker located in HK, tampers with RIR data
 278 country:        HK
 279 drop:           yes
 280
 281 aut-num:        AS141746
 282 descr:          Orenji Server
 283 remarks:        IP hijacker located somewhere in AP area (JP?)
 284 country:        AP
 285 drop:           yes
 286
 287 aut-num:        AS141759
 288 descr:          HONGKONG XING TONG HUI TECHNOLOGY CO.,LIMITED
 289 remarks:        Dirty ISP located in NL
 290 country:        NL
 291 drop:           yes
 292
 293 aut-num:        AS196691
 294 descr:          Get-Net LLC
 295 remarks:        IP hijacker in RU and dirty suballocations, not a safe place to go
 296 country:        RU
 297 drop:           yes
 298
 299 aut-num:        AS200391
 300 descr:          KREZ 999 EOOD
 301 remarks:        another shady customer of "Tamatiya EOOD / 4Vendeta", located in BG, tampers with RIR data
 302 country:        BG
 303 drop:           yes
 304
 305 aut-num:        AS202325
 306 descr:          4Media Ltd.
 307 remarks:        another shady customer of "Tamatiya EOOD / 4Vendeta", located in BG, tampers with RIR data
 308 country:        BG
 309 drop:           yes
 310
 311 aut-num:        AS202425
 312 descr:          IP Volume Inc.
 313 remarks:        bulletproof ISP (aka: AS29073 / Ecatel Ltd. / Quasi Networks Ltd.) located in NL
 314 country:        NL
 315 drop:           yes
 316
 317 aut-num:        AS202476
 318 descr:          Nevermind Inc.
 319 remarks:        Shady ISP in an extremely dirty neighborhood, tampers with RIR data, traces back to RU
 320 country:        RU
 321 drop:           yes
 322
 323 aut-num:        AS202769
 324 descr:          Cooperative Investments LLC
 325 remarks:        bulletproof ISP and IP hijacker, related to AS202425 and AS62355, traces to NL
 326 country:        NL
 327 drop:           yes
 328
 329 aut-num:        AS204341
 330 descr:          Purple Raccoon Ltd.
 331 remarks:        Bulletproof ISP in an extremely dirty neighborhood full of IP hijackers
 332 country:        RU
 333 drop:           yes
 334
 335 aut-num:        AS204428
 336 descr:          SS-Net
 337 remarks:        another shady customer of "Tamatiya EOOD / 4Vendeta", located in BG, tampers with RIR data
 338 country:        BG
 339 drop:           yes
 340
 341 aut-num:        AS204655
 342 descr:          Novogara Ltd.
 343 remarks:        bulletproof ISP (strongly linked to AS202425) located in NL
 344 country:        NL
 345 drop:           yes
 346
 347 aut-num:        AS205702
 348 descr:          Get-Net LLC
 349 remarks:        IP hijacker in RU and dirty suballocations, not a safe place to go
 350 country:        RU
 351 drop:           yes
 352
 353 aut-num:        AS206728
 354 descr:          Media Land LLC
 355 remarks:        bulletproof ISP, see: https://krebsonsecurity.com/2019/07/meet-the-worlds-biggest-bulletproof-hoster/
 356 country:        RU
 357 drop:           yes
 358
 359 aut-num:        AS209272
 360 descr:          Alviva Holding Limited
 361 remarks:        bulletproof ISP operating from a war zone in eastern UA
 362 country:        UA
 363 drop:           yes
 364
 365 aut-num:        AS209559
 366 descr:          Truenetwork IDC (?)
 367 remarks:        Rogue ISP (linked to AS202425) located in NL
 368 country:        NL
 369 drop:           yes
 370
 371 aut-num:        AS209654
 372 descr:          Delis LLC
 373 remarks:        Shary Serverion customer and IP hijacker in NL, many RIR data for announced prefixes contain garbage
 374 country:        NL
 375 drop:           yes
 376
 377 aut-num:        AS210848
 378 descr:          Telkom Internet LTD
 379 remarks:        Rogue ISP (linked to AS202425) located in NL
 380 country:        NL
 381 drop:           yes
 382
 383 aut-num:        AS211193
 384 descr:          ABDILAZIZ UULU ZHUSUP
 385 remarks:        bulletproof ISP and IP hijacker, traces to RU
 386 country:        RU
 387 drop:           yes
 388
 389 aut-num:        AS211805
 390 descr:          Media Land LLC
 391 remarks:        bulletproof ISP, see: https://krebsonsecurity.com/2019/07/meet-the-worlds-biggest-bulletproof-hoster/
 392 country:        RU
 393 drop:           yes
 394
 395 aut-num:        AS211849
 396 descr:          Kakharov Orinbassar Maratuly
 397 remarks:        ISP and IP hijacker located in KZ, many RIR data for announced prefixes contain garbage
 398 country:        KZ
 399 drop:           yes
 400
 401 aut-num:        AS212552
 402 descr:          BitCommand LLC
 403 remarks:        Dirty ISP located somewhere in EU, cannot trust RIR data of this network
 404 country:        EU
 405 drop:           yes
 406
 407 aut-num:        AS213058
 408 descr:          Private Internet Hosting LTD
 409 remarks:        bulletproof ISP located in RU
 410 country:        RU
 411 drop:           yes
 412
 413 aut-num:        AS213194
 414 descr:          Alfa Web Solutions Ltd
 415 remarks:        Rogue ISP (linked to AS57717) located in NL
 416 country:        NL
 417 drop:           yes
 418
 419 aut-num:        AS267712
 420 descr:          EL ALAMO S.R.L
 421 remarks:        Hijacked AS being announced out of RU
 422 country:        RU
 423 drop:           yes
 424
 425 aut-num:        AS328543
 426 descr:          Sun Network Company Limited
 427 remarks:        IP hijacker, traces back to AP region
 428 country:        AP
 429 drop:           yes
 430
 431 aut-num:        AS328671
 432 descr:          Datapacket Maroc SARL
 433 remarks:        bulletproof ISP (strongly linked to AS202425) located in NL
 434 country:        NL
 435 drop:           yes
 436
 437 aut-num:        AS393889
 438 descr:          EightJoy Network LLC
 439 remarks:        Most likely hijacked AS
 440 drop:           yes
 441
 442 aut-num:        AS398478
 443 descr:          PEG TECH INC
 444 remarks:        ISP located in HK, tampers with RIR data
 445 country:        HK
 446 drop:           yes
 447
 448 aut-num:        AS398993
 449 descr:          PEG TECH INC
 450 remarks:        ISP located in JP, tampers with RIR data
 451 country:        JP
 452 drop:           yes
 453
 454 aut-num:        AS399195
 455 descr:          PEG TECH INC
 456 remarks:        ISP located in KR, tampers with RIR data
 457 country:        KR
 458 drop:           yes
 459
 460 aut-num:        AS399674
 461 descr:          INTERNET HOSTSPACE GLOBAL INC
 462 remarks:        Shady ISP located in US, solely announcing "Cloud Innovation Ltd." space - no one will miss it
 463 country:        US
 464 drop:           yes
 465
 466 net:            195.133.20.0/24
 467 descr:          Tribeka Web Advisors S.A.
 468 remarks:        Tampers with RIR data, traces back to NL, not a safe place to route traffic to
 469 country:        NL
 470 drop:           yes
 471
 472 net:            196.11.32.0/20
 473 descr:          Sanlam Life Insurance Limited
 474 remarks:        Stolen AfriNIC IPv4 space announced from NL?
 475 country:        NL
 476 drop:           yes
 477
 478 net:            2a0e:b107:17fe::/47
 479 descr:          Amarai-Network - Location Test @ Antarctic
 480 remarks:        Tampers with RIR data, not a safe place to route traffic to
 481 drop:           yes
 482
 483 net:            2a0e:b107:d10::/44
 484 descr:          NZB.si Enterprises
 485 remarks:        Tampers with RIR data, not a safe place to route traffic to
 486 drop:           yes
 487
 488 net:            2a0f:7a80::/29
 489 descr:          ASLINE Limited
 490 remarks:        APNIC chunk owned by a HK-based IP hijacker, but assigned to DE
 491 country:        HK
 492 drop:           yes
 493
 494 net:            2a10:9700::/29
 495 descr:          1337TEAM LIMITED / eliteteam[.]to
 496 remarks:        Owned by an offshore letterbox company, suspected rogue ISP
 497 country:        RU
 498 drop:           yes