Hurricane Electric's IPv6 Tunnel Broker Forums

Tunnelbroker.net Specific Topics => Questions & Answers => Topic started by: idealneck on January 22, 2026, 01:42:58 AM

Title: rwhois.he.net:4321 is down; could this be the cause for wrong geoip?
Post by: idealneck on January 22, 2026, 01:42:58 AM
The geoip for my address range is out of date in most geoip database for a week now and I'm wondering if the cause is that the whois server isn't responding. It is actually correct at https://tunnelbroker.net/export/google

I am not exactly sure how geofeeds work but my understanding is that the whois server would reference the geofeed URL in the whois and geoip providers end up ingesting that. I am thinking that the whois being down means they are no longer checking that geofeed.

rwhois.he.net:4321 is specifically down, the web interface is https://rwhois.he.net up but the whois server itself gets a connection refused response.
Title: Re: rwhois.he.net:4321 is down; could this be the cause for wrong geoip?
Post by: snarked on January 26, 2026, 02:26:09 AM
What makes you think that most geoip databases follow the whois referral or RFC 8805 data to begin with?  Some only list the info from the RIRs in their address allocation databases.  All of this is up to each geoip feeds' discretion.

As long as your own info is correct in each publishing of the above original sources, you have done all that you can do.
Title: Re: rwhois.he.net:4321 is down; could this be the cause for wrong geoip?
Post by: idealneck on January 29, 2026, 10:18:26 AM
I thought the whois referral might have a link to https://tunnelbroker.net/export/google.

I asked a geoip provider (forgot which, I had submitted to various different geoip providers asking for my geolocation to be updated; most have done so at this point) to fetch https://tunnelbroker.net/export/google but one of them stated that it had to be linked to in the whois data before they would trust it.
Title: Re: rwhois.he.net:4321 is down; could this be the cause for wrong geoip?
Post by: idealneck on January 29, 2026, 10:25:32 AM
Cloudflare does the following for their WARP service:

$ whois 104.16.0.0
% IANA WHOIS server
% for more information on IANA, visit http://www.iana.org
% This query returned 1 object

refer:        whois.arin.net

inetnum:      104.0.0.0 - 104.255.255.255
organisation: ARIN
status:      ALLOCATED

whois:        whois.arin.net

changed:      2011-02
source:      IANA

# whois.arin.net

NetRange:      104.16.0.0 - 104.31.255.255
CIDR:          104.16.0.0/12
NetName:        CLOUDFLARENET
NetHandle:      NET-104-16-0-0-1
Parent:        NET104 (NET-104-0-0-0-0)
NetType:        Direct Allocation
OriginAS:
Organization:  Cloudflare, Inc. (CLOUD14)
RegDate:        2014-03-28
Updated:        2024-09-04
Comment:        All Cloudflare abuse reporting can be done via https://www.cloudflare.com/abuse
Comment:        Geofeed: https://api.cloudflare.com/local-ip-ranges.csv
Ref:            https://rdap.arin.net/registry/ip/104.16.0.0

QuoteComment:        Geofeed: https://api.cloudflare.com/local-ip-ranges.csv