{ "version": "https://jsonfeed.org/version/1.1", "title": "AJ Van Beest — Playbooks", "home_page_url": "https://ajvanbeest.com/playbooks/", "feed_url": "https://ajvanbeest.com/playbooks/feed.json", "description": "Playbooks from ajvanbeest.com. I build robots to fight cybercrime. Writing, projects, notes and playbooks on security automation and agentic systems; every page is also available as markdown (.md) and JSON (.json).", "language": "en-US", "authors": [ { "name": "AJ Van Beest", "url": "https://ajvanbeest.com/" } ], "items": [ { "id": "https://ajvanbeest.com/playbooks/geoip-lookup/", "url": "https://ajvanbeest.com/playbooks/geoip-lookup/", "title": "Playbook: Find the Geolocation of an External IP Address", "summary": "Determine the geographic location of an external IP address using multiple sources, and validate that the results are consistent.", "content_html": "

Purpose

\n

Determine the geographic location of an external IP address using multiple sources, and validate that the results are consistent.

\n

Required Tools & Access

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ToolAccess NeededFree Tier?Notes
IPinfo.ioAPI token or web interfaceYes (50k/month)Privacy detection requires paid plan
ip-api.comNo auth for non-commercialYesIncludes proxy/hosting flags
VirusTotalAPI key or web interfaceYes (limited)
AbuseIPDBAPI key or web interfaceYes (1k/day)Tor/proxy detection
Tor Exit Node ListNoneYesOfficial Tor Project list
\n

You need at least two geolocation sources to cross-validate results.

\n

Input

\n\n

Steps

\n

1. Query IPinfo.io

\n

Web interface:

\n
    \n
  1. Go to https://ipinfo.io
    2. \n
  2. Enter the IP address in the search box
    3. \n
  3. Record: City, Region, Country, Organization, ASN
    4. \n
\n

API:

\n
curl \"https://ipinfo.io/{IP_ADDRESS}?token={YOUR_TOKEN}\"
\n

Record the following fields:

\n\n

2. Query ip-api.com

\n

Web interface:

\n
    \n
  1. Go to http://ip-api.com
    2. \n
  2. The IP appears in the URL; modify to: http://ip-api.com/json/{IP_ADDRESS}
    3. \n
  3. Record: City, Region, Country, ISP, AS
    4. \n
\n

API:

\n
curl \"http://ip-api.com/json/{IP_ADDRESS}\"
\n

Record the following fields:

\n\n

3. Query VirusTotal (optional but recommended)

\n

Web interface:

\n
    \n
  1. Go to https://virustotal.com
    2. \n
  2. Click “Search” and enter the IP address
    3. \n
  3. Go to the “Details” tab
    4. \n
  4. Record: Country, ASN, Network
    5. \n
\n

API:

\n
curl --header \"x-apikey: {YOUR_API_KEY}\" \\\n  \"https://www.virustotal.com/api/v3/ip_addresses/{IP_ADDRESS}\"
\n

Record from data.attributes:

\n\n

4. Check for VPN/Proxy/Tor

\n

This step determines whether the IP is masking its true origin.

\n

4a. Check ip-api.com flags

\n

If you queried ip-api.com in Step 2, check these additional fields in the response:

\n\n

API (with extra fields):

\n
curl \"http://ip-api.com/json/{IP_ADDRESS}?fields=status,country,city,isp,as,proxy,hosting\"
\n

4b. Check AbuseIPDB

\n

Web interface:

\n
    \n
  1. Go to https://abuseipdb.com
    2. \n
  2. Enter the IP address
    3. \n
  3. Look for: Usage Type, ISP, and “Is Tor” flag
    4. \n
\n

API:

\n
curl -G \"https://api.abuseipdb.com/api/v2/check\" \\\n  --data-urlencode \"ipAddress={IP_ADDRESS}\" \\\n  -H \"Key: {YOUR_API_KEY}\" \\\n  -H \"Accept: application/json\"
\n

Record from response:

\n\n

4c. Check Tor Exit Node List

\n

Manual check:

\n
    \n
  1. Download the list: https://check.torproject.org/torbulkexitlist
    2. \n
  2. Search for the IP address in the file
    3. \n
  3. If found, the IP is a known Tor exit node
    4. \n
\n

Command line:

\n
curl -s \"https://check.torproject.org/torbulkexitlist\" | grep -q \"{IP_ADDRESS}\" && echo \"TOR EXIT NODE\" || echo \"Not a Tor exit\"
\n

Summary: Privacy/Anonymization Flags

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
CheckResult
ip-api proxy flag
ip-api hosting flag
AbuseIPDB usageType
AbuseIPDB isTor
Tor exit node list
\n

Interpretation:

\n\n

Validation

\n

Compare the results from each source:

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
FieldIPinfo.ioip-api.comVirusTotal
Country
City/Region
ASN/Org
\n

Validation checks:

\n
    \n
  1. \n

    Country match: Do all sources agree on the country?

    \n\n
    2. \n
  2. \n

    City/Region match: Do at least 2 sources agree on city or region?

    \n\n
    3. \n
  3. \n

    ASN/Org match: Do the ASN numbers match?

    \n\n
    4. \n
\n

Known limitations:

\n\n

Output

\n

Produce a summary in this format:

\n
IP Address: {IP}\nLookup Date: {YYYY-MM-DD}\n\nLocation:\n  Country: {country} (confidence: high/medium/low)\n  City/Region: {city, region} (confidence: high/medium/low)\n\nNetwork:\n  ASN: {asn}\n  Organization: {org name}\n\nPrivacy/Anonymization:\n  Tor Exit Node: {yes/no}\n  Proxy/VPN Detected: {yes/no/unknown}\n  Hosting/Datacenter: {yes/no}\n  ⚠️ Location Reliability: {reliable / unreliable - anonymized}\n\nValidation:\n  Sources queried: {list sources}\n  Country consensus: {yes/no}\n  City consensus: {yes/no}\n\nNotes:\n  {any discrepancies or flags}
\n

Important: If any privacy/anonymization flag is positive, add a warning that the geolocation data represents the proxy/VPN/Tor endpoint, NOT the actual user location.

\n

Logging

\n

Record the following in your investigation log or ticket:

\n
    \n
  1. The IP address queried
    2. \n
  2. Date/time of lookup
    3. \n
  3. Sources consulted
    4. \n
  4. Location results: Country, City/Region, confidence level
    5. \n
  5. Network info: ASN, Organization
    6. \n
  6. Privacy flags: Tor, Proxy/VPN, Hosting/Datacenter
    7. \n
  7. Location reliability assessment
    8. \n
  8. Any discrepancies noted
    9. \n
  9. Analyst name or “automated” if run by script
    10. \n
\n

Example log entry:

\n
[2026-01-01 14:30] GeoIP lookup for 203.0.113.42\nSources: IPinfo.io, ip-api.com, VirusTotal, AbuseIPDB, Tor list\nResult: Netherlands, Amsterdam (high confidence)\nASN: AS12345 - Example Hosting Inc.\nPrivacy: Not Tor, no proxy detected, hosting=yes (datacenter IP)\nNotes: All geo sources agree. Datacenter IP suggests server or VPN endpoint.\nAnalyst: AJ
\n

Automation Notes

\n

This playbook is a good candidate for scripting because:

\n\n

A script should:

\n
    \n
  1. Accept IP as input
    2. \n
  2. Query all configured sources
    3. \n
  3. Compare results automatically
    4. \n
  4. Output the summary format above
    5. \n
  5. Flag discrepancies for human review
    6. \n
", "date_published": "2026-01-01T00:00:00.000Z", "tags": [ "security", "playbooks", "geoip", "osint", "investigation" ], "_ajvanbeest": { "lane": "playbooks", "maturity": "evergreen", "markdown_url": "https://ajvanbeest.com/playbooks/geoip-lookup.md", "json_url": "https://ajvanbeest.com/playbooks/geoip-lookup.json" } } ] }