block whole countries

best tool to lookup IP ranges

[smallcompany]

I see that the ranges 59.56.109.x and 59.56.110.x are hitting me with requesting other IP addresses and files like prxjdg.cgi (some proxy judge ?)

Since I have no customers that would belong to those specific ranges (China), I thought I could start blocking countries.

I wonder what would be the best online tool (site) for finding where a certain IP range belongs.

Thanks

[phred]

. misunderstood the question.

[wilderness]

In the event that your merely attempting to ID a single range?
Use an assortment of ARIN, RIPE and APNIC.
Check ARIN first and the result will provide if another registrar is necessary.

In the event that your looking to obtain ALL IP's for a specific country try a geo targeting database [ip2location.com] ?

edited by wilderness:

Some similar threads.

[webmasterworld.com...]
[webmasterworld.com...]
[webmasterworld.com...]

[dstiles]

I use Sam Spade - the download, not the web site - to determine IP ranges. Unfirtunately it falls down on getting details of sub-ranges of many of the Asian blocks, although it gives complete ranges.

I've been getting an increasing number of Chinese scrapes and bots during the past few weeks and I'm also looking into country-blocking on my server. In my case I have to worry about a few of my clients who actually trade in Asia, South Americe and Russia, so I'll have to offer blocking opt-out on a site basis.

[Mokita]

The very best way to get APNIC ranges is to go to APNIC itself. That way you know that they are 100% accurate and up-to-date.

Here is the link for China:

[apnic.net...]

To find ranges for other Asian countries just change the two letter country code on the end of the URL to tw, jp, th, in, or vn etc.

[edited by: Mokita at 10:39 pm (utc) on Mar. 18, 2009]

[Lazlo]

Thanks Mokita.

[smallcompany]

Thanks to everyone.

I assume that there are no cases where IP range would change from one to another country. Sounds totally impossible, but I could not resist asking.

[dstiles]

There are some annoyances that work cross-country - eg netdirekt - and I've seen a few small blocks in the wrong country: US seems to do that quite a bit. Generally small stuff and I wouldn't expect the exploit countries to have anything serious. Watch for the big-3 SE bots coming in from china etc.

[smallcompany]

So, it would still be the best to block just the ranges found "guilty"?

I asked all the questions in this thread as I'm annoyed by mostly injection requests and attacks like onto PHPadmin where I see some IP ranges kind of repeating.

[blend27]

or simply compile 2 DBs (whitelisted and not) from

ftp://ftp.apnic.net/pub/stats/afrinic/delegated-afrinic-latest
ftp://ftp.ripe.net/ripe/stats/delegated-ripencc-latest
ftp://ftp.lacnic.net/pub/stats/lacnic/delegated-lacnic-latest
ftp://ftp.arin.net/pub/stats/arin/delegated-arin-latest

every few weeks or so for the countries that we do bussness with.

--netdirekt--
not to hijack the thread but always ment to ask: are humans using that ISP at all?

[thetrasher]

Watch out, some RIR database entries are wrong. Example: 62.109/19 does not belong to a company from LU = Luxembourg as stated, no, it is RU = Russia! As what I see, there are more and more false/fake entries in RIR databases, especially at RIPE NCC.

Additionally, some US/European providers offer US/European IPs for Chinese companies. And if someone is using a satellite connection, you may only locate the provider, so that US and European IPs may be used by i.e. Nigerians.

I assume that there are no cases where IP range would change from one to another country.

Well, wrong ;)

1. Any "owner" of an IP range can modify the database entry freely (see above).
   
2. A company can buy a competitor from another country. As a result, RIR database entries may change.
   
3. IP ranges can be reassigned to another country. Example: 213.6/15 was assigned to a German provider, but since 2006 213.6/16 belongs to a Palestinian company and 213.7/16 belongs to a company from Cyprus.
   
4. Subsidiary companies may share an IP range. Example: 213.100/14 belongs to a Swedish company. Subranges go to subsidiaries (Russia, Estonia, Germany, Austria, Switzerland, Netherlands, Spain, Portugal, ...) and may change anytime.
   
5. IP subranges and single IPs assigned to a customer from another country may be given in the databases - or not. Sometimes you can get additional informations about ARIN IPs through RWhois, sometimes not.

ftp://ftp.ripe.net/ripe/stats/delegated-ripencc-latest

I found some inconsistencies between "delegated" and RIR database data. I remember that some IP ranges were delegated to other countries than mentioned in the RIPE database, i.e. RU was delegated to DE.

Here is the link for China:

http://www.apnic.net/apnic-bin/ipv4-by-country.pl?country=cn

These are only official Chinese IP ranges in Asia (APNIC). China is in Europe, too. Example: 91.196.232/22 (see also spamhaus.org, ROK7829: Russian Business Network - The Russians go "Chinese")

--netdirekt--
not to hijack the thread but always ment to ask: are humans using that ISP at all?

German server farm. There are not many humans in a data center.