Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #275141

Re: WHOIS rejection from strange IP address

Show all headers | View raw

On 2024/12/02 12:02 PM, Andy Smith wrote:
> Hi,
>
> On Mon, Dec 02, 2024 at 11:34:52AM -0500, vince@wlcr.net wrote:
>> On 2024/11/27 01:57 AM, Timothy M Butterworth wrote:
>>>      I get a similar but slightly different error message.
>>>
>>>      tmb@hp-debian:~$ whois 191.96.36.56
>>>      % IP Client: 2607:fb90:db98:991c:6b9d:c93f:73d:7514
>>>      % This is the RIPE Database query service.
> […]
>
>>>      %ERROR:201: access denied for 190.112.52.14
>>>      %
>>>      % Queries from your IP address have passed the daily limit of
>>>      controlled objects.
>>>      % Access from your host has been temporarily denied.
>>>      % For more information, see
>>>      %
>>>      https://docs.db.ripe.net/FAQ/#why-did-i-receive-an-error-201-access-denied
>>>
>>>
>>>      % This query was served by the RIPE Database Query Service version
>>>      1.114 (ABERDEEN)
>>>
>>>       Show my ip address says my public IPv4 address is 172.59.137.156.
>>>      I do not know where 190.112.52.14 is coming from.
> (Worth noting that Tim's query came from
> 2607:fb90:db98:991c:6b9d:c93f:73d:7514 so not even the same address
> family as 190.112.52.14. I get the same result and my queries are over
> IPv6 to RIPE as well.)
>
>> Why is a Debian command default setup blocked by RIPE?
> I imagine the proxy is at the RIPE end, i.e. it's a reverse proxy.
>
> Perhaps someone should report this to RIPE.
>
> Interestingly so far I can only replicate it with "whois" in Debian 11,
> not Debian 12.
>
> When I do:
>
>      $ whois 191.96.36.56
>
> on Debian 11, it consistently contacts 2001:13c7:7020:210::16
> (whois-pdo.lacnic.net) which I assume internally contacts RIPE.
>
> When I do same on Debian 12 it consistently contacts
> 2001:13c7:7002:4128::150 (whois-gru-s2.whois.lacnic.net).
>
> On Debian 11 I can make it work by forcing it to try
> whois-gru-s2.whois.lacnic.net first:
>
>      $ whois -h whois-gru-s2.whois.lacnic.net 191.96.36.56
>
> I don't know if this outdated config of Debian's "whois", or some
> misconfiguration at RIPE/lacnic. Obviously whois does have a config file
> which it uses to choose whois servers to try, and those servers can
> become out of date or break.
>
> Thanks,
> Andy
>
Hmm.   Interesting point.  No idea how to troubleshoot that one.
Would that not be subject of a Debian update?

So with that unresolved,
here's a new one of the same problem:

$ whois 191.96.36.52
% IP Client: 64.253.x.x
% This is the RIPE Database query service.
% The objects are in RPSL format.
%
% The RIPE Database is subject to Terms and Conditions.
% See https://docs.db.ripe.net/terms-conditions.html

%ERROR:201: access denied for 168.121.184.15
%
% Sorry, access from your host has been permanently
% denied because of a repeated excessive querying.
% For more information, see
% https://docs.db.ripe.net/FAQ/#why-did-i-receive-an-error-201-access-denied

% This query was served by the RIPE Database Query Service version 1.114 
(SHETLAND)

I have nothing to do with 168.121.184.15.

Short of packet capture and analysis, Is there such a thing as a 
traceroute following a command like whois?

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

WHOIS rejection from strange IP address "vince@wlcr.net" <vince@wlcr.net> - 2024-11-26 22:10 +0100
  Re: WHOIS rejection from strange IP address Eike Lantzsch ZP5CGE / KY4PZ <zp6cge@gmx.net> - 2024-11-26 22:50 +0100
  Re: WHOIS rejection from strange IP address Timothy M Butterworth <timothy.m.butterworth@gmail.com> - 2024-11-27 08:00 +0100
    Re: WHOIS rejection from strange IP address Timothy M Butterworth <timothy.m.butterworth@gmail.com> - 2024-11-27 08:00 +0100
      Re: WHOIS rejection from strange IP address "vince@wlcr.net" <vince@wlcr.net> - 2024-12-02 17:40 +0100
        Re: WHOIS rejection from strange IP address John Hasler <john@sugarbit.com> - 2024-12-02 18:00 +0100
          Re: WHOIS rejection from strange IP address Andy Smith <andy@strugglers.net> - 2024-12-02 18:10 +0100
        Re: WHOIS rejection from strange IP address Andy Smith <andy@strugglers.net> - 2024-12-02 18:10 +0100
          Re: WHOIS rejection from strange IP address "vince@wlcr.net" <vince@wlcr.net> - 2024-12-02 18:40 +0100
            Re: WHOIS rejection from strange IP address John Hasler <john@sugarbit.com> - 2024-12-02 19:20 +0100
            Re: WHOIS rejection from strange IP address Andy Smith <andy@strugglers.net> - 2024-12-02 21:10 +0100
    Re: WHOIS rejection from strange IP address George at Clug <Clug@goproject.info> - 2024-11-27 08:40 +0100
      Re: WHOIS rejection from strange IP address Lee <ler762@gmail.com> - 2024-11-27 17:50 +0100

csiph-web