I was editing an IT Security stack exchange question to add geolocation information to a Tor question and I noticed that one of the 10 hard coded directory authorities is ambiguous about its location:

Is Faravahar of ./src/or/config.c at Line 859 hosted in Mauritius as implied by Tor whois or in Washington D.C. as implied by standard geolocation services?

This could of course just be the usual differences between the location of a NIC registrar and an actual server; but then why is Faravahar ( the only hard coded node using a registrar not of the node's hosting country? I'm curious.

2 Answers 2


This netblock was owned by PSINet, one of the first and early ISPs. PSINet was purchased by Cogent many years ago, and thus Cogent became the owner of the netblock ( At some point IANA, or ARIN, or AfriNIC, or all of the above decided that the supernet to which belongs,, was allocated to Africa. You can see that switch here:

Now just because IANA decides to reallocate a /8 doesn't mean everyone in that /8 loses their IP space. That would be disastrous to all involved, obviously. So Cogent maintains ownership of, while IP space around them is allocated to African providers. Unless Cogent decides to return, it will also be so.

So why does, and, show up in Mauritius?

This is because the address of AfriNIC is in Mauritius:

OrgName: African Network Information Center
Address: Level 11ABC
Address: Raffles Tower
Address: Lot 19, Cybercity
City: Ebene
Country: MU

This is the default setting for all IP space allocated to AfriNIC (Africa). It remains the setting until the IP space is allocated to an African provider, at which point the whois is updated to reflect the provider's address. Since isn't and won't be allocated to an African provider, the address remains the address of AfriNIC.


I would say that is located in the US, most probably DC area.

Let's look at whois

% This is the AfriNIC Whois server.

% Note: this output has been filtered.

% Information related to ' -'

inetnum: -
netname:        NET-154-35-0-0
descr:          __________________________
descr:          This block is allocated to an organization in the ARIN
descr:          region. Please query whois.arin.net for more
descr:          information on the registrant.
descr:          __________________________
country:        MU
org:            ORG-AFNC1-AFRINIC
admin-c:        TEAM-AFRINIC
tech-c:         TEAM-AFRINIC
mnt-by:         AFRINIC-HM-MNT
source:         AFRINIC # Filtered
parent: -

country: MU is where the Tor whois get their location from. While usually correct, this specific /16 seems to have been sold (see the descr lines).

You can see further info when calling whois --host whois.arin.net as suggested in the whois above, which yields that this /16 has been sold to PSINet, Inc. in DC.:

NetRange: -
OriginAS:       AS174
NetName:        COGENT-154-35-16
NetHandle:      NET-154-35-0-0-1
Parent:         NET-154-0-0-0-0
NetType:        Direct Assignment
RegDate:        1992-02-05
Updated:        2011-05-27
Ref:            http://whois.arin.net/rest/net/NET-154-35-0-0-1

OrgName:        PSINet, Inc.
OrgId:          PSI-2
Address:        1015 31st St NW
City:           Washington
StateProv:      DC
PostalCode:     20007
Country:        US
RegDate:        1990-10-08
Updated:        2009-01-26
Ref:            http://whois.arin.net/rest/org/PSI-2

As the Tor whois does not do this step of recursion, it displays Mauritius and confuses you.

  • Do you know why Faravahar is using a registrar not of its hosting country? It does give the false impression that jurisdictional risk is spread over an extra country. Commented Oct 5, 2013 at 22:35
  • Traceroute indicates it's in the Chicago area. Commented Oct 9, 2013 at 3:18
  • @LateralFractal: I guess there is no intention in that. See SiNA Rabbanis answer for details of the IP-space move.
    – zhenech
    Commented Oct 9, 2013 at 5:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .