Author: B.Wan Kenobi (22 Feb 12 3:27am)
Hi, it sounds like sometimes the country mapping for IPs isn't working properly; for example. the entry related to 220.127.116.11, that is
lists the country as "unknown"; now, I don't know how you implemented the country detection, but a relatively easy way to implement it would be using the CYMRU DNS lists; basically, you start by issuing a TXT query like
dig 18.104.22.168.origin.asn.cymru.com. TXT
which will result in the following infos
"49335 | 22.214.171.124/21 | RU | ripencc | 2011-06-27"
then willing to collect some more data (the above already lists the AS number and the country to which the IP block is assigned to) you may go on using the returned AS number to run a second query like
dig as49335.asn.cymru.com. TXT
which in turn will return the following
"49335 | CZ | ripencc | 2009-05-20 | NCONNECT-AS Navitel Rusconnect Ltd"
so, now we know that the AS number is allocated to CZ but that the IP (the netblock) is a Russian one; for furter infos you may look at
but in any case, I think that the above will avoid listing IP countries as "unknown"
my 2 cents