@@ -44,6 +44,11 @@ descr: VPN de Mexico, S.A. de C.V.
remarks: VPN provider
is-anonymous-proxy: yes
+aut-num: AS32781
+descr: Defender cloud international LLC
+remarks: VPN provider [high confidence, but not proofed]
+is-anonymous-proxy: yes
+
aut-num: AS34962
descr: Epik Network
remarks: Shady ISP and registrar, many prefixes announced refer to "anonymize" infrastructure
@@ -236,6 +241,11 @@ descr: Business VPN LLC
remarks: VPN provider
is-anonymous-proxy: yes
+aut-num: AS398271
+descr: HardenedVPN[.]com LLC
+remarks: VPN provider
+is-anonymous-proxy: yes
+
net: 2.57.171.0/24
descr: VPN Consumer Network
remarks: VPN provider
@@ -476,6 +486,11 @@ descr: Shtrauh Andrey
remarks: VPN provider [high confidence, but not proofed]
is-anonymous-proxy: yes
+net: 45.147.56.0/23
+descr: OLMERA GROUP LTD
+remarks: VPN provider [high confidence, but not proofed]
+is-anonymous-proxy: yes
+
net: 45.151.115.0/24
descr: ikoProxies [high confidence, but not proofed]
remarks: VPN provider located in NL
@@ -489,7 +504,7 @@ is-anonymous-proxy: yes
net: 45.192.0.0/12
descr: Cloud Innovation Ltd.
-remarks: hijacked AFRINIC IP chunk owned by an offshore company, routed to several dirty networks worldwide, cannot tell what is going on here
+remarks: hijacked (?) AFRINIC IP chunk owned by an offshore company, routed to several dirty networks worldwide, cannot tell what is going on here
is-anonymous-proxy: yes
net: 45.220.72.0/22
@@ -1131,6 +1146,11 @@ remarks: (Rogue) VPN provider
is-anonymous-proxy: yes
country: EU
+net: 185.164.59.0/24
+descr: Buyproxies / Yuli Azarch
+remarks: VPN provider [high confidence, but not proofed]
+is-anonymous-proxy: yes
+
net: 185.165.153.0/24
descr: Privacy Matters VPN service / nVPN / David Craig
remarks: (Rogue) VPN provider
@@ -1384,6 +1404,11 @@ descr: VPNClientPublics
remarks: VPN provider
is-anonymous-proxy: yes
+net: 198.44.224.0/19
+descr: Defender cloud international LLC
+remarks: VPN provider [high confidence, but not proofed]
+is-anonymous-proxy: yes
+
net: 199.249.223.0/24
descr: Quintex Alliance Consulting
remarks: Tor relay provider
@@ -1454,6 +1479,11 @@ descr: SecuredConnectivity
remarks: VPN provider
is-anonymous-proxy: yes
+net: 206.123.128.0/19
+descr: Secure Internet LLC
+remarks: VPN provider
+is-anonymous-proxy: yes
+
net: 209.107.176.0/20
descr: Google VPN
remarks: VPN provider
@@ -30,11 +30,21 @@ descr: Akamai Technologies, Inc.
remarks: Worldwide CDN, does not make sense to assign their networks to a specific country
is-anycast: yes
+aut-num: AS20577
+descr: TRADEWEB EUROPE LIMITED
+remarks: Generic anycast network [high confidence, but not proofed]
+is-anycast: yes
+
aut-num: AS20940
descr: Akamai International BV
remarks: Worldwide CDN, does not make sense to assign their networks to a specific country
is-anycast: yes
+aut-num: AS28064
+descr: Smart Data Center S.A.
+remarks: Generic anycast network [high confidence, but not proofed]
+is-anycast: yes
+
aut-num: AS31529
descr: DENIC eG
remarks: TLD operator's anycast network
@@ -45,6 +55,11 @@ descr: Citigroup
remarks: Public anycast DNS resolver network [high confidence, but not proofed]
is-anycast: yes
+aut-num: AS34738
+descr: WEBHOST LIMITED
+remarks: Generic anycast network [high confidence, but not proofed]
+is-anycast: yes
+
aut-num: AS34868
descr: wasted.io Ltd.
remarks: Generic anycast network
@@ -80,6 +95,11 @@ descr: coreIT.pl
remarks: Generic anycast network
is-anycast: yes
+aut-num: AS60626
+descr: Leaseweb CDN B.V.
+remarks: Generic anycast network
+is-anycast: yes
+
aut-num: AS60890
descr: CentralNic Ltd
remarks: Generic anycast network
@@ -95,6 +115,11 @@ descr: OpenTLD BV
remarks: TLD operator's anycast network
is-anycast: yes
+aut-num: AS61072
+descr: EZNet LIMITED
+remarks: Generic anycast network
+is-anycast: yes
+
aut-num: AS62766
descr: SJB Communications
remarks: Generic anycast network
@@ -160,6 +185,11 @@ descr: ipcom GmbH
remarks: Generic anycast network
is-anycast: yes
+aut-num: AS209242
+descr: Cloudflare London, LLC / Cloudflare Spectrum
+remarks: CFs' "bring your own IP networks and we will announce it" AS, lots of shady announcements originated from there, clients are located worldwide as single peer is CF's main AS
+is-anycast: yes
+
aut-num: AS209813
descr: Fast Content Delivery Ltd.
remarks: Generic anycast network
@@ -13,6 +13,11 @@
# Please keep this file sorted.
#
+aut-num: AS1820
+descr: WNET TELECOM USA Corp.
+remarks: traces back to various locations in UA, seems to tamper with RIR data
+country: UA
+
aut-num: AS3216
descr: PJSC "Vimpelcom"
remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage
@@ -23,6 +28,11 @@ descr: XNNET LLC
remarks: traces back to an unknown oversea location (HK?), seems to tamper with RIR data
country: HK
+aut-num: AS7203
+descr: Leaseweb USA, Inc.
+remarks: ISP located in US, but some RIR data for announced prefixes contain garbage
+country: US
+
aut-num: AS8359
descr: MTS PJSC
remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage
@@ -58,16 +68,36 @@ descr: Yes Networks Unlimited Ltd
remarks: traces to UA, but some RIR entries seem to contain garbage (VG)
country: UA
+aut-num: AS24961
+descr: myLoc managed IT AG
+remarks: ISP located in DE, but some RIR data for announced prefixes contain garbage
+country: DE
+
aut-num: AS25098
descr: Netcalibre Ltd.
-remarks: ISP located in GB, but some RIR data for announced prefixes contain garbage/
+remarks: ISP located in GB, but some RIR data for announced prefixes contain garbage
country: GB
+aut-num: AS27411
+descr: Leaseweb USA, Inc.
+remarks: ISP located in US, but some RIR data for announced prefixes contain garbage
+country: US
+
aut-num: AS28098
descr: ABGON Comunicaciones
remarks: ISP located in CL, but some RIR data for announced prefixes contain garbage (BZ)
country: CL
+aut-num: AS28753
+descr: Leaseweb Deutschland GmbH
+remarks: ISP located in Frankfurt/Main, DE, but many RIR data for announced prefixes contain garbage
+country: DE
+
+aut-num: AS30633
+descr: Leaseweb USA, Inc.
+remarks: ISP located in US, but some RIR data for announced prefixes contain garbage (BZ)
+country: US
+
aut-num: AS35042
descr: IP Interactive UG (haftungsbeschraenkt)
remarks: ISP located in BG, but RIR data for announced prefixes contain garbage
@@ -163,6 +193,11 @@ descr: Global Colocation Limited
remarks: part of a dirty ISP conglomerate most likely operating out of SE
country: SE
+aut-num: AS48721
+descr: ADM Service Ltd.
+remarks: traces back to Vilnius, LT
+country: LT
+
aut-num: AS49466
descr: KLAYER LLC
remarks: part of the "Asline" IP hijacking gang, traces back to AP region
@@ -233,6 +268,11 @@ descr: INNETRA PC
remarks: another shady customer of "DDoS Guard Ltd.", jurisdiction is probably RU, but traceroutes dead-end somewhere else in EU
country: EU
+aut-num: AS59253
+descr: Leaseweb Asia Pacific pte. ltd.
+remarks: ISP located in SG, but some RIR data for announced prefixes contain garbage
+country: SG
+
aut-num: AS59580
descr: Batterflyai Media Ltd.
remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage
@@ -248,6 +288,11 @@ descr: Inter Connects Inc. / Jing Yun
remarks: part of a dirty ISP conglomerate operating most likely out of SE, hijacking AfriNIC networks
country: SE
+aut-num: AS60781
+descr: LeaseWeb Netherlands B.V.
+remarks: ISP located in Amsterdam, NL, but many RIR data for announced prefixes contain garbage
+country: NL
+
aut-num: AS61977
descr: Vivo Trade L.P.
remarks: another shady customer of "DDoS Guard Ltd."
@@ -283,11 +328,31 @@ descr: NForce Entertainment BV
remarks: currently hijacks a single stolen /20 AfriNIC IPv4 net, hosted in NL
country: NL
+aut-num: AS132369
+descr: XIANGAO INTERNATIONAL TELECOMMUNICATION LIMITED
+remarks: ISP located in HK, tampers with RIR data
+country: HK
+
+aut-num: AS133752
+descr: Leaseweb Asia Pacific pte. ltd.
+remarks: ISP located in HK, some RIR data for announced prefixes contain garbage
+country: HK
+
+aut-num: AS134351
+descr: Leaseweb Japan K.K.
+remarks: ISP located in JP, some RIR data for announced prefixes contain garbage
+country: JP
+
aut-num: AS134548
descr: DXTL Tseung Kwan O Service
remarks: tampers with RIR data, traces back to AP region
country: AP
+aut-num: AS136988
+descr: Leaseweb Australia Pty. Ltd.
+remarks: ISP located in AU, some RIR data for announced prefixes contain garbage
+country: AU
+
aut-num: AS137443
descr: Anchnet Asia Limited
remarks: IP hijacker located in HK, tampers with RIR data
@@ -298,11 +363,26 @@ descr: Clayer Limited
remarks: part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to AP region
country: AP
+aut-num: AS138571
+descr: SUPERCLOUDS LIMITED
+remarks: ISP located in HK, tampers with RIR data
+country: HK
+
+aut-num: AS139242
+descr: Cloudflare Sydney, LLC
+remarks: ... but CF failed to set the country for announced prefixes to AU as well :-/
+country: AU
+
aut-num: AS139330
descr: SANREN DATA LIMITED
remarks: IP hijacker located somewhere in AP region, tampers with RIR data
country: AP
+aut-num: AS139811
+descr: ANLIAN NETWORK TECHNOLOGY CO., LIMITED
+remarks: ISP located in HK, tampers with RIR data
+country: HK
+
aut-num: AS140733
descr: Wujidun Network Limited
remarks: part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to AP region
@@ -323,6 +403,11 @@ descr: Datashield, Inc.
remarks: fake offshore location (SC), traces back to NL
country: NL
+aut-num: AS200740
+descr: Network Management Ltd.
+remarks: traceroutes dead-end somewhere in or near RU
+country: RU
+
aut-num: AS200845
descr: AVATEL TELECOM
remarks: ISP located in ES, but some RIR data for announced prefixes contain garbage
@@ -388,6 +473,11 @@ descr: Hauer Hosting Services Limited
remarks: ISP located in ES, but some RIR data for announced prefixes contain garbage
country: ES
+aut-num: AS205544
+descr: LEASEWEB UK LIMITED
+remarks: ISP located in London, GB, but many RIR data for announced prefixes contain garbage
+country: GB
+
aut-num: AS206397
descr: Genius Guard / Genius Security Ltd.
remarks: another shady customer of "DDoS Guard Ltd.", probably located in RU
@@ -403,6 +493,11 @@ descr: Xtudio Networks S.L.U.
remarks: ISP located in ES, but some RIR data for announced prefixes contain garbage
country: ES
+aut-num: AS207569
+descr: Network Management Ltd.
+remarks: traceroutes dead-end somewhere in or near RU
+country: RU
+
aut-num: AS207616
descr: Altrosky Technology Ltd.
remarks: fake offshore location (SC), traces back to CZ and NL
@@ -458,6 +553,11 @@ descr: Harry Dowd
remarks: ISP located in GB, but RIR data for announced prefixes contain garbage
country: GB
+aut-num: AS212962
+descr: Quality Area Ltd.
+remarks: traceroutes dead-end somewhere near Crimera, UA
+country: UA
+
aut-num: AS213035
descr: Serverion BV
remarks: ISP located in NL, but RIR data for most announced prefixes contain garbage
@@ -488,6 +588,16 @@ descr: Datapacket Maroc SARL
remarks: bulletproof ISP (strongly linked to AS202425) located in NL
country: NL
+aut-num: AS394380
+descr: Leaseweb USA, Inc.
+remarks: ISP located in Dallas, TX, US, but some RIR data for announced prefixes contain garbage
+country: US
+
+aut-num: AS395954
+descr: Leaseweb USA, Inc.
+remarks: ISP located in US, but some RIR data for announced prefixes contain garbage
+country: US
+
aut-num: AS398478
descr: PEG TECH INC
remarks: ISP located in HK, tampers with RIR data