IP Country origin wrong

Question

Hi, 
 
 We have a new internet connection since a month, and the external ip adress of that line is not in the correct country. 
 We have ip 130.255.171.129 and acording to the ripe database it's in the Netherlands and that's correct. Only our branch office Sophos XG says the IP is Italian. 
 Ripe: 
 
 % This is the RIPE Database query service.
% The objects are in RPSL format.
%
% The RIPE Database is subject to Terms and Conditions.
% See http://www.ripe.net/db/support/db-terms-conditions.pdf

% Note: this output has been filtered.
% To receive output for a database update, use the "-B" flag.

% Information related to '130.255.171.0 - 130.255.171.255'

% Abuse contact for '130.255.171.0 - 130.255.171.255' is 'abuse@artofautomation.net'

inetnum: 130.255.171.0 - 130.255.171.255
netname: NL-ARTOF4-20210827
country: NL
org: ORG-AOAB5-RIPE
admin-c: AOA30-RIPE
tech-c: AOA30-RIPE
status: ALLOCATED PA
mnt-by: RIPE-NCC-HM-MNT
mnt-by: MNT-AOA
created: 2021-08-27T11:15:18Z
last-modified: 2022-11-15T12:07:34Z
source: RIPE Sophos XG: Where does the XG get's it's info and why is this incorrect? Bart.

LuCar Toni · Accepted Answer

SFOS uses maxmind. 
 Maxmind is claiming Italy: https://www.maxmind.com/en/geoip-demo 
 You can do a change request to maxmind and this will be reflected to SFOS as well. www.maxmind.com/.../geoip-data-correction-request

LuCar Toni · Answer

GEOIP is not a security feature. 
 It never was and it never will be. 
 And actually if you want to workaround this, you will start a VPN client and easily exploit this system. So GEOIP is something to nail down a reporting database. 
 But maxmind as a vendor has some feedback about there data: https://support.maxmind.com/hc/en-us/articles/4407630607131-Geolocation-Accuracy 
 Personally i am not a friend of geoip blocking, as i am not seeing the value in it. There are actually 10 ways i can workaround this in one second. So what is the point? Some say: to get the noise of the internet to a minimum: Yeah fair enough, the database is fine for this Purpose. 
 But if an attacker wants to exploit you, they will not use there real IP in any way, they will use masq ips, as this is the most secure way for them. And Maxmind claims to do checks for there data as well. They will not simply move this because of somebody claiming the data was not right.

IP Country origin wrong

Top Replies