@@ -285,11 +285,6 @@ remarks: VPN provider located in ES
is-anonymous-proxy: yes
country: ES
-aut-num: AS213224
-descr: Blue Black Squared Limited
-remarks: Owned by an offshore letterbox company, claims NL, but dead-ends in DE - hard to tell what is going on here
-is-anonymous-proxy: yes
-
aut-num: AS394087
descr: Secure Internet LLC / PureVPN
remarks: VPN provider
@@ -149,11 +149,6 @@ descr: Blue Diamond Network Co., Ltd.
remarks: Hiding behind fake ISP Navitgo LLC (AS59721), tampers with RIR data
country: NL
-aut-num: AS18013
-descr: ASLINE LIMITED
-remarks: IP hijacker, traces back to AP region
-country: AP
-
aut-num: AS18185
name: Northern Taiwan Community University
remarks: has no sane AS name set in APNIC DB
@@ -173,31 +168,16 @@ descr: EGIHosting
remarks: ISP located in US, but some RIR data for announced prefixes contain garbage
country: US
-aut-num: AS207711
-descr: Inteldome Corporation
-remarks: ... whose location we are unable to determine precisely, but its definitely not MH :-/
-country: EU
-
aut-num: AS21100
descr: ITL LLC
remarks: ISP headquatered in BG and/or UA, physically located in NL, some RIR data for announced prefixes contain inaccurate data
country: NL
-aut-num: AS22769
-descr: DDOSING NETWORK
-remarks: IP hijacker located somewhere in AP, massively tampers with RIR data
-country: AP
-
aut-num: AS23858
descr: xTom Pty. Ltd.
remarks: ISP located in AU, RIR data for announced prefixes contain garbage
country: AU
-aut-num: AS24009
-descr: HK UNITE TELECOMMUNICATIONS DEVELOPMENT LIMITED
-remarks: IP hijacker (?) located in HK, tampers with RIR data
-country: HK
-
aut-num: AS24700
descr: Yes Networks Unlimited Ltd
remarks: traces to UA, but some RIR entries seem to contain garbage (VG)
@@ -218,6 +198,11 @@ descr: Unicycle, LLC
remarks: traces back to NL
country: NL
+aut-num: AS26636
+descr: GBTCloud, Inc.
+remarks: ISP located in US, but some RIR data for announced prefixes contain garbage
+country: US
+
aut-num: AS27411
descr: Leaseweb USA, Inc.
remarks: ISP located in US, but some RIR data for announced prefixes contain garbage
@@ -358,6 +343,11 @@ descr: Rack Sphere Hosting S.A.
remarks: claims PA for some prefixes, but they are all hosted in CH
country: CH
+aut-num: AS40021
+descr: Contabo Inc.
+remarks: ISP located in US, but some RIR data for announced prefixes contain garbage
+country: US
+
aut-num: AS40034
descr: Confluence Networks Inc.
remarks: fake offshore location (VG), traces back to Austin, TX, US
@@ -373,13 +363,8 @@ descr: MLAB Open Source Community
remarks: traces back to DE
country: DE
-aut-num: AS41466
-descr: Treidinvest LLC
-remarks: another shady customer of "Tamatiya EOOD / 4Vendeta", located in BG, tampers with RIR data
-country: BG
-
aut-num: AS41564
-descr: Packet Exchange Limited
+descr: Orion Network Limited
remarks: shady uplink for a bunch of dirty ISPs in SE (and likely elsewhere in EU), routing stolen AfriNIC networks, RIR data of prefixes announced by this AS cannot be trusted
country: SE
@@ -409,7 +394,7 @@ remarks: ISP located in GB, but some RIR data for announced prefixes contain gar
country: GB
aut-num: AS42960
-descr: Cloud Management LLC
+descr: VH Global Limited
remarks: tampers with RIR data, traces back to AP area
country: AP
@@ -418,11 +403,6 @@ descr: DGN TEKNOLOJI A.S.
remarks: ISP located in TR, but many RIR data for announced prefixes contain garbage
country: TR
-aut-num: AS43092
-descr: Kirin Communication Limited
-remarks: tampers with RIR data, traces back to AP area
-country: AP
-
aut-num: AS43310
descr: TOV "LVS"
remarks: ISP located in UA, but some RIR data for announced prefixes contain garbage
@@ -453,11 +433,6 @@ descr: NbIServ
remarks: ISP located in DE, but some RIR data for announced prefixes contain garbage
country: DE
-aut-num: AS44015
-descr: Landgard Management Inc.
-remarks: bulletproof ISP with strong links to RU
-country: RU
-
aut-num: AS44477
descr: IP Oleinichenko Denis
remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage
@@ -468,6 +443,11 @@ descr: Skylink Data Center BV
remarks: ISP located in NL, but some RIR data for announced prefixes contain garbage
country: NL
+aut-num: AS44901
+descr: Belcloud LTD
+remarks: ISP located in BG, but some RIR data for announced prefixes contain garbage
+country: BG
+
aut-num: AS44992
descr: KeonWoo PARK
remarks: claims US for its prefixes announced, but traces back to KR
@@ -493,6 +473,11 @@ descr: Spectre Operations BV
remarks: ISP located in NL, but some RIR data for suballocations of announced prefixes contain garbage
country: NL
+aut-num: AS48024
+descr: NEROCLOUD Ltd.
+remarks: RIR data faked/incorrect, cannot trust this network
+country: EU
+
aut-num: AS48158
descr: DigitalOne AG
remarks: Services appear to be hosted in RU, RIR data faked/incorrect
@@ -545,7 +530,7 @@ country: NL
aut-num: AS50360
descr: Tamatiya EOOD / 4Vendeta
-remarks: Questionable (at best) ISP located in BG, clients massively tamper with RIR data
+remarks: Questionable ISP located in BG, clients massively tamper with RIR data
country: BG
aut-num: AS50673
@@ -553,6 +538,11 @@ descr: Serverius Holding B.V.
remarks: ISP located in NL, but some RIR data for announced prefixes contain garbage
country: NL
+aut-num: AS51167
+descr: Contabo GmbH
+remarks: ISP located in DE, but some RIR data for announced prefixes contain garbage
+country: DE
+
aut-num: AS51089
descr: SALTYFISH TECH LTD
remarks: traceroutes dead-end somewhere near HK
@@ -638,11 +628,6 @@ descr: ULTRANEX LTD
remarks: fake offshore location (CY), hosted in NL
country: NL
-aut-num: AS58271
-descr: FOP Gubina Lubov Petrivna
-remarks: bulletproof ISP operating from a war zone in eastern UA
-country: UA
-
aut-num: AS58294
descr: CloudWall Ltd.
remarks: RIR data neither contain a postal address nor a phone number, traceroutes end in Sofia, BG
@@ -1080,14 +1065,24 @@ country: US
aut-num: AS207569
descr: Network Management Ltd.
-remarks: traceroutes dead-end somewhere in or near RU
-country: RU
+remarks: traceroutes dead-end somewhere in or near CZ
+country: CZ
aut-num: AS207616
descr: Altrosky Technology Ltd.
remarks: fake offshore location (SC), traces back to CZ and NL
country: EU
+aut-num: AS207711
+descr: Inteldome Corporation
+remarks: ... whose location we are unable to determine precisely, but its definitely not MH :-/
+country: EU
+
+aut-num: AS207968
+descr: Internetservice Hahn
+remarks: AQ != DE, you know
+country: DE
+
aut-num: AS208046
descr: Maximilian Kutzner trading as HostSlick
remarks: traces back to NL, but some RIR data for announced prefixes contain garbage
@@ -1098,11 +1093,6 @@ descr: Access2.IT Group B.V.
remarks: ISP located in NL, but some RIR data for announced prefixes contain garbage
country: NL
-aut-num: AS208410
-descr: Internet Hosting Ltd.
-remarks: another shady customer of "Tamatiya EOOD / 4Vendeta", located in BG, tampers with RIR data
-country: BG
-
aut-num: AS208485
descr: Nese Mala / Moon DC
remarks: shady ISP located in TR, but many RIR data for announced prefixes contain garbage
@@ -1118,11 +1108,6 @@ descr: Miti 2000 EOOD
remarks: another shady customer of "Tamatiya EOOD / 4Vendeta", located in BG, tampers with RIR data
country: BG
-aut-num: AS209272
-descr: Alviva Holding Limited
-remarks: bulletproof ISP operating from a war zone in eastern UA
-country: UA
-
aut-num: AS209366
descr: SEMrush CY LTD
remarks: claims CY for announced prefixes, but they are all hosted in NL
@@ -1148,6 +1133,11 @@ descr: VPSSC Networks LTD
remarks: ISP located in UA, but RIR data for announced prefixes contain garbage
country: UA
+aut-num: AS210654
+descr: Des Capital B.V.
+remarks: Shady ISP located in NL, but RIR data for announced prefixes contain garbage
+country: NL
+
aut-num: AS210848
descr: Telkom Internet LTD
remarks: shady ISP currently located in NL
@@ -1203,6 +1193,11 @@ descr: MILEGROUP LTD
remarks: traceroutes dead-end somewhere in Central Europe
country: EU
+aut-num: AS212552
+descr: BitCommand LLC
+remarks: Hides behind a CDN ISP, traceroutes dead-end somewhere in Central Europe
+country: EU
+
aut-num: AS212667
descr: RECONN LLC
remarks: ISP located in RU, but RIR data for announced prefixes contain garbage
@@ -1218,11 +1213,6 @@ descr: Serverion BV
remarks: ISP located in NL, but RIR data for most announced prefixes contain garbage
country: NL
-aut-num: AS213058
-descr: Private Internet Hosting LTD
-remarks: bulletproof ISP located in RU
-country: RU
-
aut-num: AS213194
descr: Alfa Web Solutions Ltd.
remarks: shady ISP located in NL
@@ -1263,6 +1253,11 @@ descr: xTom Limited
remarks: ISP located in ZA, RIR data for announced prefixes contain garbage
country: ZA
+aut-num: AS328227
+descr: Xhostserver LLC
+remarks: ISP located in ZA, many RIR data for announced prefixes contain garbage
+country: ZA
+
aut-num: AS328543
descr: Sun Network Company Limited
remarks: IP hijacker, traces back to AP region
@@ -1398,6 +1393,11 @@ descr: IPv4 Superhub Limited
remarks: network owned by an HK company, traces back to HK as well - but is assigned to DE. Nice try...
country: HK
+net: 45.129.136.0/24
+descr: Flyservers S.A.
+remarks: fake offshore location (PA), traces back to NL
+country: NL
+
net: 45.134.12.0/24
descr: MS Network LTD
remarks: fake offshore location (SC), traces back to NL
@@ -1493,6 +1493,21 @@ descr: PSINet, Inc. (PSI) / Cogent Communications
remarks: Cogent IP range used in Europe, according to ARIN whois ("COGENT-EUROPEAN-OPERATIONS-001")
country: EU
+net: 141.98.82.0/24
+descr: Flyservers S.A.
+remarks: fake offshore location (PA), traces back to RO
+country: RO
+
+net: 141.98.83.0/24
+descr: Flyservers S.A.
+remarks: fake offshore location (PA), traces back to RO
+country: RO
+
+net: 146.19.102.0/24
+descr: Norbert Miczuga
+remarks: ... who thinks messing with country codes is funny :-/
+country: CH
+
net: 149.22.96.0/19
descr: Manx Telecom Limited
remarks: Suballocation of Cogent, country code missing due to ARIN DB situation (https://community.ipfire.org/t/location-database-update-error-country-code/6451/)
@@ -1608,6 +1623,11 @@ descr: Openfactory GmbH
remarks: ... who thinks assigning networks to AQ is funny :-/
country: EU
+net: 2a10:ccc0::/29
+descr: Securebit AG
+remarks: ... who thinks assigning networks to AQ is funny :-/
+country: CH
+
net: 2402:e940:f00::/48
descr: Wind Cloud Network Technology Co Ltd.
remarks: appears to be used out of Tokyo, JP
@@ -26,11 +26,41 @@
# Please keep this file sorted.
#
+aut-num: AS18013
+descr: ASLINE LIMITED
+remarks: IP hijacker, traces back to AP region
+country: AP
+drop: yes
+
+aut-num: AS22769
+descr: DDOSING NETWORK
+remarks: IP hijacker located somewhere in AP, massively tampers with RIR data
+country: AP
+drop: yes
+
+aut-num: AS24009
+descr: LANLIAN INTERNATIONAL HOLDING GROUP LIMITED
+remarks: IP hijacker located in HK, tampers with RIR data
+country: HK
+drop: yes
+
aut-num: AS39770
descr: 1337TEAM LIMITED / eliteteam[.]to
remarks: Owned by an offshore letterbox company, suspected rogue ISP
drop: yes
+aut-num: AS43092
+descr: Kirin Communication Limited
+remarks: Hijacks IP space and tampers with RIR data, traces back to JP
+country: JP
+drop: yes
+
+aut-num: AS44015
+descr: Landgard Management Inc.
+remarks: bulletproof ISP with strong links to RU
+country: RU
+drop: yes
+
aut-num: AS48090
descr: PPTECHNOLOGY LIMITED
remarks: bulletproof ISP (related to AS204655) located in NL
@@ -72,6 +102,18 @@ remarks: bulletproof ISP (related to AS202425) located in NL
country: NL
drop: yes
+aut-num: AS58271
+descr: FOP Gubina Lubov Petrivna
+remarks: bulletproof ISP operating from a war zone in eastern UA
+country: UA
+drop: yes
+
+aut-num: AS58810
+descr: iZus Co., Ltd
+remarks: Autonomous System registered to offshore company, abuse contact is a freemail address, seems to trace to some location in AP vicinity
+country: AP
+drop: yes
+
aut-num: AS60424
descr: 1337TEAM LIMITED / eliteteam[.]to
remarks: Owned by an offshore letterbox company, suspected rogue ISP
@@ -83,12 +125,6 @@ remarks: bulletproof ISP (linked to AS202425 et al.) located in NL
country: NL
drop: yes
-aut-num: AS62355
-descr: Network Dedicated SAS
-remarks: bulletproof ISP and IP hijacker, claims to be located in CH, but traces to NL
-country: NL
-drop: yes
-
aut-num: AS64425
descr: SKB Enterprise B.V.
remarks: bulletproof ISP (linked to AS202425 et al.) located in NL
@@ -113,16 +149,28 @@ remarks: bulletproof ISP and IP hijacker, related to AS202425 and AS62355, trace
country: NL
drop: yes
+aut-num: AS204655
+descr: Novogara Ltd.
+remarks: bulletproof ISP (strongly linked to AS202425) located in NL
+country: NL
+drop: yes
+
aut-num: AS207812
descr: DM AUTO EOOD
remarks: another shady customer of "Tamatiya EOOD / 4Vendeta", located in BG, tampers with RIR data
country: BG
drop: yes
-aut-num: AS204655
-descr: Novogara Ltd.
-remarks: bulletproof ISP (strongly linked to AS202425) located in NL
-country: NL
+aut-num: AS209272
+descr: Alviva Holding Limited
+remarks: bulletproof ISP operating from a war zone in eastern UA
+country: UA
+drop: yes
+
+aut-num: AS213058
+descr: Private Internet Hosting LTD
+remarks: bulletproof ISP located in RU
+country: RU
drop: yes
aut-num: AS328671
@@ -131,7 +179,13 @@ remarks: bulletproof ISP (strongly linked to AS202425) located in NL
country: NL
drop: yes
+net: 2a0e:b107:d10::/44
+descr: NZB.si Enterprises
+remarks: Tampers with RIR data, not a safe place to route traffic to
+drop: yes
+
net: 2a10:9700::/29
descr: 1337TEAM LIMITED / eliteteam[.]to
remarks: Owned by an offshore letterbox company, suspected rogue ISP
+country: RU
drop: yes