Question

Locked

Whois registrants showing different information?

By DanLM ·
I have about 200 ip's that have been firewalled because of various factors(ssh brute force attempts, ftp brute force attempts, attempted ssh access from linux).

I got a bug up my butt and decided to build a database so that I could track how often a specific ip that has been firewalled made repeated attempts. Ie: same day, every day. And also, where these ip's originated from(origin country).

During some initial research, i was doing some command line whois against these ip's and for the most part the originating country was China. I then downloaded the Net::Whois::ARIN CPAN module to automate this collection process and was surprised at the results.

Where I was expecting most of the offending IP's coming from eastern countries(Korea/china), I was seeing south American originating countries. The registrant url that was being used by this CPAN module is whois.arin.net. When I changed this to whois.apnic.net, I began seeing the countries I was expecting to see. Now I haven't run any trace's against these IP's to actually see where they go back to, and I sure am not going to do that in a Perl script.

But, why the differences. Who is right? Lol, I think I'm firewalled from whois.apnic.net because I kept running the script with too much volume.

???

Dan

This conversation is currently closed to new comments.

3 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Answers

Collapse -

the only way to tell

by Jaqui In reply to Whois registrants showing ...

is to go to each whois site and look at the date on the registration record.
the latter date is the current data.

ip number blocks generally follow specific patterns, but they are transferrable, so a block can be moved from one area to another as needed.

Collapse -

ya know, there are some days I just miss the tree's for the forest

by DanLM In reply to the only way to tell

For some reason, I thought that if the ip blocks were transfered that they would no longer appear on the orgionating registrant server. Thank you Jaqui, I it just never crossed my mind.

With regard to me checking each registrant server looking for the latest change date, I'll have to think on that one. This is only a home file server, and I'm just not sure if my curiosity factor is high enough to warrant me witting that code. Yea it does, who am I kidding. It just won't happen till after the new year.

Thanks again Jaqui.

Dan

Back to Linux Forum
3 total posts (Page 1 of 1)  

Related Discussions

Related Forums