evilsocket / evilsocket/opensnitch

[Bug Report] Outdated fall-back ASN text for 94.130.142.35 (UA-D2INVESTUKRAINE-AS) and custom GeoIP file corruption error

Open
#1,640 1 comment 0 reactions 0 assignees View on GitHub
bug
Dominant language
Python
Stars
14.1k
Forks
665
PR merge metrics
No merged PRs in 30d

Description

### Describe the bug:
The built-in fallback GeoIP data maps the IP address 94.130.142.35 to an outdated malicious 2018 botnet registry string ("UA-D2INVESTUKRAINE-AS D2 International Investment Ukraine Ltd., UA") instead of its current legitimate owner (Hetzner Online GmbH / ://open-meteo.com).

Additionally, trying to change the database to a modern local MaxMind file (GeoLite2-ASN.mmdb) or an IP2Location file via preferences results in a "file is corrupted" popup warning, making it impossible to override the stale string.

Include the following information:
- OpenSnitch version: 1.8.0-1
- OS: Tuxedo OS (Ubuntu base)
- OS version: 24.04 LTS
- Window Manager: KDE Plasma
- Kernel version: `Linux 6.17.0-124040-tuxedo #40~24.04.1tux1 SMP PREEMPT_DYNAMIC Wed Jul 8 14:37:13 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux`
Running `opensnitchd -check-requirements` showed no errors.

### To Reproduce:
Steps to reproduce the behavior:
1. Allow a connection to trigger to 94.130.142.35 (e.g. use ://open-meteo.com).
2. Go to the 'Connections' tab.
3. See the outdated "UA-D2INVESTUKRAINE-AS" tag under the Country/Network column.
4. Go to Preferences -> Nodes -> Set GeoIP Database Path to a valid local .mmdb or .bin file.
5. See "file is corrupted" error on application refresh.

### Post error logs:
The GUI displays a visual popup notification warning stating that the file is corrupted when choosing a path containing newly downloaded GeoLite2-ASN.mmdb or IP2LOCATION-LITE-DB1.BIN files. Deleting ~/.config/opensnitch/settings.conf is required to restore the UI configuration.

### Expected behavior (optional):
The internal fallback tracker should accurately parse RIPE NCC registration blocks for Hetzner, and the file parser should ingest standard modern .mmdb or .bin formats without flagging data corruption.

### Screenshots:
94.130.142.35,6,"UA-D2INVESTUKRAINE-AS D2 International Investment Ukraine Ltd., UA

Image

### Additional context:
The destination IP 94.130.142.35 is explicitly confirmed by RIPE registry data to be a clean endpoint inside HETZNER-fsn1-dc4. The string error seems to be a ghost record lingering from the historical 2018 3ve BGP hijack sequence trapped inside the codebase's fallback text blocks.

Contributor guide

No contributing guide indexed for this repository

Research direction

Reproduce both behaviors with OpenSnitch 1.8.0-1: trigger a connection to 94.130.142.35, then select GeoLite2-ASN.mmdb or IP2LOCATION-LITE-DB1.BIN in Preferences → Nodes. Start with the opensnitchd -check-requirements entry point and the settings.conf configuration; done means the fallback owner is current and valid modern .mmdb or .bin files no longer produce the corruption warning.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
databases, networking, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.