Hello folks,

I have list of ips like

1.1.1.1
2.2.2.2
3.3.3.3
4.4.4.4

whois 1.1.1.1 |grep -E 'country|Country'

1.1.1.1 US
2.2.2.2 CA
3.3.3.3 FR

#!/bin/sh

while read inputline
do
  country=`whois $inputline|grep -E 'country|Country'`
   echo $inputline $country
done < /ip.txt

exit 0

50 1.1.1.1
40 2.2.2.2
30 3.3.3.3
15 4.4.4.4

IP=1.1.1.1 Country=1.1.1.1 Hits=50
IP=2.2.2.2 Country=2.2.2.2 Hits=40

Does you script actually work? I keep experiencing that almost every whois query returns two country codes. I think the first is the code for the whois server itself (not sure), and the second for the ip which is being queried. Some whois queries don't have any country code. However following while loop works pretty nice for me:

$ cat iplist
202 xxx.xxx.xxx.x
22 xxx.xx.xx.x
71 xx.xx.xxx.xx
112 xxx.xx.x.x
$ while read hits ip; do
country=$(whois "$ip" | grep -E '[Cc]ountry' | sed 's/[Cc]ountry: *//' | tr "\n" ",")
echo -n "IP=$ip Country=$country Hits=$hits" && echo
done <iplist | sed 's/, H/ H/'
IP=xxx.xxx.xxx.x Country=NL,AT Hits=202
IP=xxx.xx.xx.x Country= Hits=22
IP=xx.xx.xxx.xx Country=NL,FR Hits=71
IP=xxx.xx.x.x Country=NL,IT Hits=112
$

while read hits ip
do
   country=$(whois $ip | awk 'tolower($1) == "country:" { print $2 }')
   echo "IP=$ip  Country=$country  Hits=$hits"
done < iplist

Thanks.