Describe the bug:
The built-in fallback GeoIP data maps the IP address 94.130.142.35 to an outdated malicious 2018 botnet registry string ("UA-D2INVESTUKRAINE-AS D2 International Investment Ukraine Ltd., UA") instead of its current legitimate owner (Hetzner Online GmbH / ://open-meteo.com).
Additionally, trying to change the database to a modern local MaxMind file (GeoLite2-ASN.mmdb) or an IP2Location file via preferences results in a "file is corrupted" popup warning, making it impossible to override the stale string.
Include the following information:
- OpenSnitch version: 1.8.0-1
- OS: Tuxedo OS (Ubuntu base)
- OS version: 24.04 LTS
- Window Manager: KDE Plasma
- Kernel version:
Linux 6.17.0-124040-tuxedo #40~24.04.1tux1 SMP PREEMPT_DYNAMIC Wed Jul 8 14:37:13 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux
Running opensnitchd -check-requirements showed no errors.
To Reproduce:
Steps to reproduce the behavior:
- Allow a connection to trigger to 94.130.142.35 (e.g. use ://open-meteo.com).
- Go to the 'Connections' tab.
- See the outdated "UA-D2INVESTUKRAINE-AS" tag under the Country/Network column.
- Go to Preferences -> Nodes -> Set GeoIP Database Path to a valid local .mmdb or .bin file.
- See "file is corrupted" error on application refresh.
Post error logs:
The GUI displays a visual popup notification warning stating that the file is corrupted when choosing a path containing newly downloaded GeoLite2-ASN.mmdb or IP2LOCATION-LITE-DB1.BIN files. Deleting ~/.config/opensnitch/settings.conf is required to restore the UI configuration.
Expected behavior (optional):
The internal fallback tracker should accurately parse RIPE NCC registration blocks for Hetzner, and the file parser should ingest standard modern .mmdb or .bin formats without flagging data corruption.
Screenshots:
94.130.142.35,6,"UA-D2INVESTUKRAINE-AS D2 International Investment Ukraine Ltd., UA
Additional context:
The destination IP 94.130.142.35 is explicitly confirmed by RIPE registry data to be a clean endpoint inside HETZNER-fsn1-dc4. The string error seems to be a ghost record lingering from the historical 2018 3ve BGP hijack sequence trapped inside the codebase's fallback text blocks.
Describe the bug:
The built-in fallback GeoIP data maps the IP address 94.130.142.35 to an outdated malicious 2018 botnet registry string ("UA-D2INVESTUKRAINE-AS D2 International Investment Ukraine Ltd., UA") instead of its current legitimate owner (Hetzner Online GmbH / ://open-meteo.com).
Additionally, trying to change the database to a modern local MaxMind file (GeoLite2-ASN.mmdb) or an IP2Location file via preferences results in a "file is corrupted" popup warning, making it impossible to override the stale string.
Include the following information:
Linux 6.17.0-124040-tuxedo #40~24.04.1tux1 SMP PREEMPT_DYNAMIC Wed Jul 8 14:37:13 UTC 2026 x86_64 x86_64 x86_64 GNU/LinuxRunning
opensnitchd -check-requirementsshowed no errors.To Reproduce:
Steps to reproduce the behavior:
Post error logs:
The GUI displays a visual popup notification warning stating that the file is corrupted when choosing a path containing newly downloaded GeoLite2-ASN.mmdb or IP2LOCATION-LITE-DB1.BIN files. Deleting ~/.config/opensnitch/settings.conf is required to restore the UI configuration.
Expected behavior (optional):
The internal fallback tracker should accurately parse RIPE NCC registration blocks for Hetzner, and the file parser should ingest standard modern .mmdb or .bin formats without flagging data corruption.
Screenshots:
94.130.142.35,6,"UA-D2INVESTUKRAINE-AS D2 International Investment Ukraine Ltd., UA
Additional context:
The destination IP 94.130.142.35 is explicitly confirmed by RIPE registry data to be a clean endpoint inside HETZNER-fsn1-dc4. The string error seems to be a ghost record lingering from the historical 2018 3ve BGP hijack sequence trapped inside the codebase's fallback text blocks.