#
# override-xd [.txt]
#
# This file contains Autonomous Systems and IP networks strongly believed or proofed to be hostile,
# posing a _technical_ threat against libloc users in general and/or IPFire users in particular.
#
# libloc neither was intended to be an "opinionated" database, nor should it become that way. Please
# refer to commit 69b3d894fbee6e94afc2a79593f7f6b300b88c10 for the rationale of implementing a special
# flag for hostile networks.
#
# Technical threats cover publicly routable network infrastructure solely dedicated or massively abused to
# host phishing, malware, C&C servers, non-benign vulnerability scanners, or being used as a "bulletproof"
# hosting space for cybercrime infrastructure.
#
# This file should not contain short-lived threats being hosted within legitimate infrastructures, as
# libloc it neither intended nor suitable to protect against such threats in a timely manner - by default,
# clients download a new database once a week.
#
# Networks posing non-technical threats - i. e. not covered by the definition above - must not be listed
# here.
#
# Improvement suggestions are appreciated, please submit them as patches to the location mailing
# list. Refer to https://lists.ipfire.org/mailman/listinfo/location and https://wiki.ipfire.org/devel/contact
# for further information.
#
# Please keep this file sorted.
#

aut-num:	AS18254
descr:		KLAYER LLC
remarks:	part of the "Asline" IP hijacking gang, traces back to AP region
country:	AP
drop:		yes

aut-num:	AS18013
descr:		ASLINE LIMITED
remarks:	IP hijacker, traces back to HK
country:	HK
drop:		yes

aut-num:	AS211849
descr:		Kakharov Orinbassar Maratuly
remarks:	ISP and IP hijacker located in KZ, many RIR data for announced prefixes contain garbage
country:	KZ
drop:		yes

aut-num:	AS24009
descr:		LANLIAN INTERNATIONAL HOLDING GROUP LIMITED
remarks:	IP hijacker and bulletproof ISP, possibly located near Los Angeles, US
country:	US
drop:		yes

aut-num:	AS22769
descr:		DDOSING NETWORK
remarks:	IP hijacker located in US, massively tampers with RIR data
country:	US
drop:		yes

aut-num:	AS24009
descr:		LANLIAN INTERNATIONAL HOLDING GROUP LIMITED
remarks:	IP hijacker located in HK, tampers with RIR data
country:	HK
drop:		yes

aut-num:	AS39770
descr:		1337TEAM LIMITED / eliteteam[.]to
remarks:	Owned by an offshore letterbox company, suspected rogue ISP
drop:		yes

aut-num:	AS41564
descr:		Orion Network Limited
remarks:	shady uplink for a bunch of dirty ISPs in SE (and likely elsewhere in EU), routing stolen AfriNIC networks, RIR data of prefixes announced by this AS cannot be trusted
country:	EU
drop:		yes

aut-num:	AS43092
descr:		Kirin Communication Limited
remarks:	Hijacks IP space and tampers with RIR data, traces back to JP
country:	JP
drop:		yes

aut-num:	AS44015
descr:		Landgard Management Inc.
remarks:	bulletproof ISP with strong links to RU
country:	RU
drop:		yes

aut-num:	AS44446
descr:		OOO SibirInvest
remarks:	bulletproof ISP (related to AS202425 and AS57717) located in NL
country:	NL
drop:		yes

aut-num:	AS48090
descr:		PPTECHNOLOGY LIMITED
remarks:	bulletproof ISP (related to AS204655) located in NL
country:	NL
drop:		yes

aut-num:	AS49447
descr:		Nice IT Services Group Inc.
remarks:	Rogue ISP located in CH, but some RIR data for announced prefixes contain garbage
country:	CH
drop:		yes

aut-num:	AS51381
descr:		1337TEAM LIMITED / eliteteam[.]to
remarks:	Owned by an offshore letterbox company, suspected rogue ISP
country:	RU
drop:		yes

aut-num:	AS54600
descr:		PEG TECH INC
remarks:	ISP and IP hijacker located in US this time, tampers with RIR data
country:	US
drop:		yes

aut-num:	AS55303
descr:		Eagle Sky Co., Lt[d ?]
remarks:	Autonomous System registered to offshore company, abuse contact is a freemail address, address says "0 Market Square, P.O. Box 364, Belize", seems to trace to some location in AP vicinity
country:	AP
drop:		yes

aut-num:	AS55933
descr:		Cloudie Limited
remarks:	part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to AP region
country:	AP
drop:		yes

aut-num:	AS56611
descr:		REBA Communications BV
remarks:	bulletproof ISP (related to AS202425) located in NL
country:	NL
drop:		yes

aut-num:	AS56873
descr:		1337TEAM LIMITED / eliteteam[.]to
remarks:	Owned by an offshore letterbox company, suspected rogue ISP
drop:		yes

aut-num:	AS57523
descr:		Chang Way Technologies Co. Limited
remarks:	bulletproof ISP, C&C server hosting galore
drop:		yes

aut-num:	AS57717
descr:		FiberXpress BV
remarks:	bulletproof ISP (related to AS202425) located in NL
country:	NL
drop:		yes

aut-num:	AS57858
descr:		Inter Connects Inc.
remarks:	part of a dirty ISP conglomerate operating most likely out of SE, hijacking stolen AfriNIC networks, massively tampers with RIR data
country:	SE
drop:		yes

aut-num:	AS57972
descr:		Inter Connects Inc.
remarks:	part of a dirty ISP conglomerate operating most likely out of SE, hijacking stolen AfriNIC networks, massively tampers with RIR data
country:	SE
drop:		yes

aut-num:	AS58271
descr:		FOP Gubina Lubov Petrivna
remarks:	bulletproof ISP operating from a war zone in eastern UA
country:	UA
drop:		yes

aut-num:	AS58810
descr:		iZus Co., Ltd
remarks:	Autonomous System registered to offshore company, abuse contact is a freemail address, seems to trace to some location in AP vicinity
country:	AP
drop:		yes

aut-num:	AS60424
descr:		1337TEAM LIMITED / eliteteam[.]to
remarks:	Owned by an offshore letterbox company, suspected rogue ISP
drop:		yes

aut-num:	AS60485
descr:		Inter Connects Inc. / Jing Yun
remarks:	part of a dirty ISP conglomerate operating most likely out of SE, hijacking AfriNIC networks
country:	SE
drop:		yes

aut-num:	AS61414
descr:		EDGENAP LTD
remarks:	IP hijacking? Rogue ISP?
drop:		yes

aut-num:	AS62068
descr:		SpectraIP B.V.
remarks:	bulletproof ISP (linked to AS202425 et al.) located in NL
country:	NL
drop:		yes

aut-num:	AS64425
descr:		SKB Enterprise B.V.
remarks:	bulletproof ISP (linked to AS202425 et al.) located in NL
country:	NL
drop:		yes

aut-num:	AS136545
descr:		Blue Data Center
remarks:	IP hijacker located somewhere in AP area, tampers with RIR data
country:	AP
drop:		yes

aut-num:	AS136800
descr:		ICIDC NETWORK
remarks:	IP hijacker located in HK, suspected to be part of the "Asline" IP hijacking gang, tampers with RIR data
country:	HK
drop:		yes

aut-num:	AS137523
descr:		HONGKONG CLOUD NETWORK TECHNOLOGY CO., LIMITED
remarks:	ISP and IP hijacker located in HK, tampers with RIR data
country:	HK
drop:		yes

aut-num:	AS137951
descr:		Clayer Limited
remarks:	part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to HK
country:	HK
drop:		yes

aut-num:	AS138648
descr:		ASLINE Global Exchange
remarks:	IP hijacker located somewhere in AP area
country:	AP
drop:		yes

aut-num:	AS139330
descr:		SANREN DATA LIMITED
remarks:	IP hijacker located somewhere in AP region, tampers with RIR data
country:	AP
drop:		yes

aut-num:	AS140107
descr:		CITIS CLOUD GROUP LIMITED
remarks:	part of the "Asline" IP hijacking gang, tampers with RIR data, location unknown (AP? HK? US?)
drop:		yes

aut-num:	AS141159
descr:		Incomparable(HK)Network Co., Limited
remarks:	ISP and IP hijacker located in HK, tampers with RIR data
country:	HK
drop:		yes

aut-num:	AS141746
descr:		Orenji Server
remarks:	IP hijacker located somewhere in AP area (JP?)
country:	AP
drop:		yes

aut-num:	AS200391
descr:		KREZ 999 EOOD
remarks:	another shady customer of "Tamatiya EOOD / 4Vendeta", located in BG, tampers with RIR data
country:	BG
drop:		yes

aut-num:	AS202425
descr:		IP Volume Inc.
remarks:	bulletproof ISP (aka: AS29073 / Ecatel Ltd. / Quasi Networks Ltd.) located in NL
country:	NL
drop:		yes

aut-num:	AS202769
descr:		Cooperative Investments LLC
remarks:	bulletproof ISP and IP hijacker, related to AS202425 and AS62355, traces to NL
country:	NL
drop:		yes

aut-num:	AS204428
descr:		SS-Net
remarks:	another shady customer of "Tamatiya EOOD / 4Vendeta", located in BG, tampers with RIR data
country:	BG
drop:		yes

aut-num:	AS204655
descr:		Novogara Ltd.
remarks:	bulletproof ISP (strongly linked to AS202425) located in NL
country:	NL
drop:		yes

aut-num:	AS209272
descr:		Alviva Holding Limited
remarks:	bulletproof ISP operating from a war zone in eastern UA
country:	UA
drop:		yes

aut-num:	AS210848
descr:		Telkom Internet LTD
remarks:	Rogue ISP (linked to AS202425) located in NL
country:	NL
drop:		yes

aut-num:	AS211193
descr:		ABDILAZIZ UULU ZHUSUP
remarks:	bulletproof ISP and IP hijacker, traces to RU
country:	RU
drop:		yes

aut-num:	AS212552
descr:		BitCommand LLC
remarks:	Dirty ISP located somewhere in EU, cannot trust RIR data of this network
country:	EU
drop:		yes

aut-num:	AS213058
descr:		Private Internet Hosting LTD
remarks:	bulletproof ISP located in RU
country:	RU
drop:		yes

aut-num:	AS328543
descr:		Sun Network Company Limited
remarks:	IP hijacker, traces back to AP region
country:	AP
drop:		yes

aut-num:	AS328671
descr:		Datapacket Maroc SARL
remarks:	bulletproof ISP (strongly linked to AS202425) located in NL
country:	NL
drop:		yes

aut-num:	AS393889
descr:		EightJoy Network LLC
remarks:	All prefixes announced by this network are hijacked
drop:		yes

aut-num:	AS398478
descr:		PEG TECH INC
remarks:	ISP located in HK, tampers with RIR data
country:	HK
drop:		yes

aut-num:	AS398993
descr:		PEG TECH INC
remarks:	ISP located in JP, tampers with RIR data
country:	JP
drop:		yes

aut-num:	AS399195
descr:		PEG TECH INC
remarks:	ISP located in KR, tampers with RIR data
country:	KR
drop:		yes

net:		196.11.32.0/20
descr:		Sanlam Life Insurance Limited
remarks:	Stolen AfriNIC IPv4 space announced from NL
country:	NL
drop:		yes

net:		2a0e:b107:d10::/44
descr:		NZB.si Enterprises
remarks:	Tampers with RIR data, not a safe place to route traffic to
drop:		yes

net:		2a0f:7a80::/29
descr:		ASLINE Limited
remarks:	APNIC chunk owned by a HK-based IP hijacker, but assigned to DE
country:	HK
drop:		yes

net:		2a10:9700::/29
descr:		1337TEAM LIMITED / eliteteam[.]to
remarks:	Owned by an offshore letterbox company, suspected rogue ISP
country:	RU
drop:		yes