[l008com]

Here's my situation. Particularly on my Mac repair website, I get lots of 1-off contact form spam. 1-off meaning its not a bot, it's an actual person. That person is in china, and wants me to buy knock-off Apple parts from them. It's a form so I can easily test the sender's IP and block anyone in China and/or Korea. So I'm wondering if there are any fast/easy/short cut ways to do country-only whois lookups. I have a Maxmind account for another website, but I don't want to pay for my lookups. And a full whois from the terminal will give the country, but thats really slower than what I'd like. Plus it outputs a huge long mess, not the clean and easily machine readable results I'd like.

[besson3c]

You could come up with your own GeoIP based spam filter, do you run your own SMTP server?

Other ways:

- firewall block China from even accessing your website
- update your form processing at the application level to omit submissions from Chinese IP blocks

[besson3c]

The geoiplookup binary included in the GeoIP C package is very straight forward:

# geoiplookup forums.macnn.com
GeoIP Country Edition: US, United States

It would not be terribly hard to create a very simple GeoIP based SMTP gateway.

[l008com]

What does that program use to do the lookups?

[besson3c]

Itself, the GeoIP database:

MaxMind - GeoLite Country | Open Source IP Address to Country Database

You can download the SQL based database of netblock to country mappings, or use the C binary for faster lookups which is what I did above. A lot of applications and companies rely on this tool.