Threatintel WHOIS - 50% of country code's and organizations are "N/A"

Hej @tomjcollins85

my personal recommendation is - for country lookup - do not use the thread-intel plugin.

Why? Every lookup will create a WHOIS call and you might get rate limited (what might happen right now) just because of the amount of lookups you do.

If you want to have the country, let first the geoip-lookup plugin do the work. That is an offline call to the local database. You might only want to update the maxmind database on tuesday to have the latest version running.

Only if that lookup did not deliver a match, do the whois lookup. That will give you some additional performance.

/jd