Dear Peter The "country:" attribute in the RIPE Database can be set by the resource Holder to any valid, international country code. It has little meaning to anyone other than the resource Holder. Only they know what they had in mind when they set it. To explain the problem simply, it could be the country where the resource Holder is physically located, or the country of a data centre or the country where the resource is being used. This has been discussed a few times at RIPE Meetings but no consensus has been reached on a strict definition of this attribute. The RIPE NCC has just published an article on RIPE Labs about an idea to separate some of the registration data in the RIPE Database into two parts. A fixed part containing data supplied to the RIPE NCC by the resource Holder and another part with data the resource Holder can change at any time. In the prototype we have included "country:" in both parts of this data. The intention is to have a strict definition of what 'country' means from a registration perspective in the fixed part of the data. https://labs.ripe.net/Members/Paul_P_/a-new-ripe-database-prototype I hope this helps. Regards Denis Walker Business Analyst RIPE NCC Database Group Peter Kosinar wrote:

Hello!

This might not be the appropriate place for my question; if that is so, I apologize in advance.

I've noticed that the data provided by the RIPE WHOIS database is sometimes inconsistent with the data shown in the delegated-ripencc-latest file, available from the ftp://ftp.ripe.net/ripe/stats/ server. For example, consider these two entries:

------------------------------------------------------- $ whois 91.212.135.0/24

inetnum: 91.212.135.0 - 91.212.135.255 netname: YABA-NET descr: YabaMedia Ltd country: RU

$ grep 91.212.135.0 delegated-ripencc-latest ripencc|CZ|ipv4|91.212.135.0|256|20090409|assigned ------------------------------------------------------- $ whois 193.105.207.0/24

inetnum: 193.105.207.0 - 193.105.207.255 netname: ALFAHOSTNET descr: Alfa-host LLP. country: KZ

$ grep 193.105.207.0 delegated-ripencc-latest ripencc|CZ|ipv4|193.105.207.0|256|20100315|assigned -------------------------------------------------------

As you can see, the data differs in the "country" field -- in both cases, the range is attributed to Czech Republic, while the block is actually assigned to anothers. Since the delegated-ripencc-latest file is used by some reputable and often-used sources (like Team Cymru; http://www.team-cymru.org/Services/ip-to-asn.html), this can sometime result in misleading and completely useless reports (as you can probably guess, it was Czech Republic getting unfair load of hostile sites attributed to it).

There are two questions now: 1) What is the source of this discrepancy?

2) If it was caused by some kind of an error, can the databases be put in sync? If it is intentional, which source is more "reliable"?

Thanks,

Peter