I’ve been using Whois every now and then to ban ip ranges outside the USA where there is suspicious activity coming from.

The variety of responses is a lot. And it seems like you’re not required to provide accurate information other than just one field (ipaddr or something like that). For example I’ll see an allocation that has over a million addresses but in their Whois text they say they’re a /24 network (256 addresses). This happens with Chinese networks every single time so I have to calculate the correct network…

(Sorry, commuting right now so I can’t show examples here)