WHOIS tells you where an IP is supposed to be located, but BGP determines where the IP is actually located. They don't have to agree and both can be hacked/spoofed.
WHOIS tells you the address of the organization (as they supply it) the IP addresses are allocated to, nothing more.
> BGP determines where the IP is actually located
No, BGP determines the path through the Internet, via various ISPs, that your packets take to get to their destination.
Luckily, AFAIK, BGP is trust-based, so things go to normal pretty quickly.
http://www.ripe.net/internet-coordination/news/industry-deve...
In reality, most ISPs (that I've dealt with, anyway) do prefix filtering to prevent just this sort of thing.
There are rather obvious limits, however, for example you will likely have to believe your ISP C if he says ‘I AM ISP B NOW, TOO’. If you then connect to another ISP D, and tell him ‘I KNOW ISP B’, D will have to decide whether to trust you (likely if you are a large telecom company) or not (if you just happen to have two 10 MBit/s lines to C and D each).
Not quite.