FeedDiscussion
Great write-up. The "country from a dropdown" detail explains a lot of the geolocation mismatches people see. When registry data can't be trusted, looking at the ASN's classification and its upstreams is often more telling than the WHOIS country. The ipgeolocation.io ASN API (ipgeolocation.io/documentation/asn-api.html) returns classification, allocation date and peering/upstream info, and the Abuse Contact API (ipgeolocation.io/documentation/ip-abuse-contact-a…) returns the registered abuse contacts for an IP. Neither fixes the white-labeling problem you describe, but they make the gaps easier to spot.
Dražen Višnjić
Critical digital infrastructure, public procurement, and cybersecurity records in Republika Srpska (AIKT).
Incredible deep dive into an area most people overlook. The erosion of the WHOIS attribution chain and the exploitation of RFC 8805 geofeeds create massive challenges for threat intelligence and sanctions tracking. Thanks for shedding light on how industrial-scale obfuscation actually works.