I am trying to extract OrgId from whois query to detect malicious servers.
whois 69.59.28.19 | grep OrgId: | awk '{print $2}'
But for some IPs there are multiple OrgId entries.
whois 69.59.28.19
whois 208.115.113.93
What is the reason of this kind of double Organization information in WhoIs answers?
And which OrgId should be chosen to detect malicious IP owner?
