Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Maxmind: Use registered_country instead of country #1344

Merged

Conversation

th-certbund
Copy link
Contributor

MaxMind provides different country attributes for an IP:

  • country: Country where MaxMind believes the user is located.
  • registered_country: Country registered with the network range.

Incidents are usually reported to the network owner responsible for the affected IP or the respective national CSIRT. So in particular for CDN networks or satellite providers, we are not interested in the country a user is (potentially) located but in the location of the network owner.

Example for DE vs. US:

network:IP-Network:38.87.230.0/23
network:Org-Name:Interlax Telecom
network:Street-Address:50 NE 9th St.
network:City:Miami
network:State:FL
network:Country:US

Maxmind results:

country: DE
registered_country: US

Example for DE vs. AF:

inetnum:        180.222.136.0 - 180.222.143.0
netname:        Etisalat
descr:          Etisalat Afghanistan
country:        AF

Maxmind results:

country: DE
registered_country: AF

@codecov-io
Copy link

codecov-io commented Oct 23, 2018

Codecov Report

Merging #1344 into develop will not change coverage.
The diff coverage is 0%.

@@           Coverage Diff            @@
##           develop    #1344   +/-   ##
========================================
  Coverage    74.63%   74.63%           
========================================
  Files          295      295           
  Lines        13518    13518           
  Branches      1831     1831           
========================================
  Hits         10089    10089           
  Misses        3015     3015           
  Partials       414      414
Impacted Files Coverage Δ
intelmq/bots/experts/maxmind_geoip/expert.py 25.64% <0%> (ø) ⬆️

@ghost ghost added this to the 1.2.0 milestone Oct 23, 2018
@ghost
Copy link

ghost commented Oct 23, 2018

cc @aaronkaplan

@ghost ghost added the component: bots label Oct 23, 2018
@ghost ghost merged commit b224ca5 into certtools:develop Feb 4, 2019
@ghost
Copy link

ghost commented Feb 4, 2019

I extended it a bit by introducing a parameter use_registered to ensure backwards-compatibility and the possibility to chose. And at the chance I also fixed the docs.
26a64e0

@ghost ghost self-assigned this Feb 4, 2019
@ghost ghost modified the milestones: 1.2.0, 2.0.0 Apr 9, 2019
This pull request was closed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants