{ "title": "Playbook: Find the Geolocation of an External IP Address", "subtitle": null, "description": "Determine the geographic location of an external IP address using multiple sources, and validate that the results are consistent.", "lane": "playbooks", "slug": "geoip-lookup", "url": "https://ajvanbeest.com/playbooks/geoip-lookup/", "maturity": "evergreen", "date": "2026-01-01", "updated": null, "tags": [ "security", "playbooks", "geoip", "osint", "investigation" ], "wordCount": 974, "readingMinutes": 5, "markdown": "## Purpose\n\nDetermine the geographic location of an external IP address using multiple sources, and validate that the results are consistent.\n\n\n## Required Tools & Access\n\n| Tool | Access Needed | Free Tier? | Notes |\n|------|---------------|------------|-------|\n| [IPinfo.io](https://ipinfo.io) | API token or web interface | Yes (50k/month) | Privacy detection requires paid plan |\n| [ip-api.com](http://ip-api.com) | No auth for non-commercial | Yes | Includes proxy/hosting flags |\n| [VirusTotal](https://virustotal.com) | API key or web interface | Yes (limited) | |\n| [AbuseIPDB](https://abuseipdb.com) | API key or web interface | Yes (1k/day) | Tor/proxy detection |\n| [Tor Exit Node List](https://check.torproject.org/torbulkexitlist) | None | Yes | Official Tor Project list |\n\nYou need at least two geolocation sources to cross-validate results.\n\n\n## Input\n\n- One external IPv4 or IPv6 address (e.g., `8.8.8.8`)\n\n\n## Steps\n\n### 1. Query IPinfo.io\n\n**Web interface:**\n1. Go to https://ipinfo.io\n2. Enter the IP address in the search box\n3. Record: City, Region, Country, Organization, ASN\n\n**API:**\n```bash\ncurl \"https://ipinfo.io/{IP_ADDRESS}?token={YOUR_TOKEN}\"\n```\n\nRecord the following fields:\n- `city`\n- `region`\n- `country`\n- `org`\n- `asn`\n\n\n### 2. Query ip-api.com\n\n**Web interface:**\n1. Go to http://ip-api.com\n2. The IP appears in the URL; modify to: `http://ip-api.com/json/{IP_ADDRESS}`\n3. Record: City, Region, Country, ISP, AS\n\n**API:**\n```bash\ncurl \"http://ip-api.com/json/{IP_ADDRESS}\"\n```\n\nRecord the following fields:\n- `city`\n- `regionName`\n- `country`\n- `isp`\n- `as`\n\n\n### 3. Query VirusTotal (optional but recommended)\n\n**Web interface:**\n1. Go to https://virustotal.com\n2. Click \"Search\" and enter the IP address\n3. Go to the \"Details\" tab\n4. Record: Country, ASN, Network\n\n**API:**\n```bash\ncurl --header \"x-apikey: {YOUR_API_KEY}\" \\\n \"https://www.virustotal.com/api/v3/ip_addresses/{IP_ADDRESS}\"\n```\n\nRecord from `data.attributes`:\n- `country`\n- `asn`\n- `as_owner`\n\n\n### 4. Check for VPN/Proxy/Tor\n\nThis step determines whether the IP is masking its true origin.\n\n#### 4a. Check ip-api.com flags\n\nIf you queried ip-api.com in Step 2, check these additional fields in the response:\n- `proxy`: true/false (detects proxy/VPN)\n- `hosting`: true/false (datacenter/hosting provider, often indicates VPN)\n\n**API (with extra fields):**\n```bash\ncurl \"http://ip-api.com/json/{IP_ADDRESS}?fields=status,country,city,isp,as,proxy,hosting\"\n```\n\n#### 4b. Check AbuseIPDB\n\n**Web interface:**\n1. Go to https://abuseipdb.com\n2. Enter the IP address\n3. Look for: Usage Type, ISP, and \"Is Tor\" flag\n\n**API:**\n```bash\ncurl -G \"https://api.abuseipdb.com/api/v2/check\" \\\n --data-urlencode \"ipAddress={IP_ADDRESS}\" \\\n -H \"Key: {YOUR_API_KEY}\" \\\n -H \"Accept: application/json\"\n```\n\nRecord from response:\n- `data.usageType` (e.g., \"Data Center/Web Hosting/Transit\")\n- `data.isTor` (true/false)\n- `data.totalReports` (abuse report count)\n\n#### 4c. Check Tor Exit Node List\n\n**Manual check:**\n1. Download the list: https://check.torproject.org/torbulkexitlist\n2. Search for the IP address in the file\n3. If found, the IP is a known Tor exit node\n\n**Command line:**\n```bash\ncurl -s \"https://check.torproject.org/torbulkexitlist\" | grep -q \"{IP_ADDRESS}\" && echo \"TOR EXIT NODE\" || echo \"Not a Tor exit\"\n```\n\n#### Summary: Privacy/Anonymization Flags\n\n| Check | Result |\n|-------|--------|\n| ip-api proxy flag | |\n| ip-api hosting flag | |\n| AbuseIPDB usageType | |\n| AbuseIPDB isTor | |\n| Tor exit node list | |\n\n**Interpretation:**\n- **Tor exit node**: Location data is meaningless; this is the exit point, not the user\n- **Proxy/VPN detected**: Location may be the VPN endpoint, not the user\n- **Hosting/Datacenter**: Likely a server, VPN endpoint, or automated traffic—not a typical end user\n\n\n## Validation\n\nCompare the results from each source:\n\n| Field | IPinfo.io | ip-api.com | VirusTotal |\n|-------|-----------|------------|------------|\n| Country | | | |\n| City/Region | | | |\n| ASN/Org | | | |\n\n**Validation checks:**\n\n1. **Country match**: Do all sources agree on the country?\n - If YES: High confidence in country-level location\n - If NO: Flag discrepancy; IP may use anycast or be misattributed\n\n2. **City/Region match**: Do at least 2 sources agree on city or region?\n - If YES: Reasonable confidence in city-level location\n - If NO: Report country only; city-level data is unreliable for this IP\n\n3. **ASN/Org match**: Do the ASN numbers match?\n - If YES: Confirms the network owner\n - If NO: Investigate further; one source may have stale data\n\n**Known limitations:**\n- VPNs, proxies, and Tor exit nodes will show the endpoint location, not the user (Step 4 helps detect these)\n- CDN and anycast IPs (e.g., Cloudflare, Google) may return multiple valid locations\n- Mobile IPs may geolocate to carrier headquarters, not actual user location\n- Privacy detection is not perfect; some VPNs use residential IPs that evade detection\n\n\n## Output\n\nProduce a summary in this format:\n\n```\nIP Address: {IP}\nLookup Date: {YYYY-MM-DD}\n\nLocation:\n Country: {country} (confidence: high/medium/low)\n City/Region: {city, region} (confidence: high/medium/low)\n\nNetwork:\n ASN: {asn}\n Organization: {org name}\n\nPrivacy/Anonymization:\n Tor Exit Node: {yes/no}\n Proxy/VPN Detected: {yes/no/unknown}\n Hosting/Datacenter: {yes/no}\n ⚠️ Location Reliability: {reliable / unreliable - anonymized}\n\nValidation:\n Sources queried: {list sources}\n Country consensus: {yes/no}\n City consensus: {yes/no}\n\nNotes:\n {any discrepancies or flags}\n```\n\n**Important:** If any privacy/anonymization flag is positive, add a warning that the geolocation data represents the proxy/VPN/Tor endpoint, NOT the actual user location.\n\n\n## Logging\n\nRecord the following in your investigation log or ticket:\n\n1. The IP address queried\n2. Date/time of lookup\n3. Sources consulted\n4. **Location results**: Country, City/Region, confidence level\n5. **Network info**: ASN, Organization\n6. **Privacy flags**: Tor, Proxy/VPN, Hosting/Datacenter\n7. Location reliability assessment\n8. Any discrepancies noted\n9. Analyst name or \"automated\" if run by script\n\n**Example log entry:**\n```\n[2026-01-01 14:30] GeoIP lookup for 203.0.113.42\nSources: IPinfo.io, ip-api.com, VirusTotal, AbuseIPDB, Tor list\nResult: Netherlands, Amsterdam (high confidence)\nASN: AS12345 - Example Hosting Inc.\nPrivacy: Not Tor, no proxy detected, hosting=yes (datacenter IP)\nNotes: All geo sources agree. Datacenter IP suggests server or VPN endpoint.\nAnalyst: AJ\n```\n\n\n## Automation Notes\n\nThis playbook is a good candidate for scripting because:\n- All steps are deterministic\n- APIs return structured data\n- Validation logic is straightforward\n\nA script should:\n1. Accept IP as input\n2. Query all configured sources\n3. Compare results automatically\n4. Output the summary format above\n5. Flag discrepancies for human review", "html": "

Purpose

\n

Determine the geographic location of an external IP address using multiple sources, and validate that the results are consistent.

\n

Required Tools & Access

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ToolAccess NeededFree Tier?Notes
IPinfo.ioAPI token or web interfaceYes (50k/month)Privacy detection requires paid plan
ip-api.comNo auth for non-commercialYesIncludes proxy/hosting flags
VirusTotalAPI key or web interfaceYes (limited)
AbuseIPDBAPI key or web interfaceYes (1k/day)Tor/proxy detection
Tor Exit Node ListNoneYesOfficial Tor Project list
\n

You need at least two geolocation sources to cross-validate results.

\n

Input

\n\n

Steps

\n

1. Query IPinfo.io

\n

Web interface:

\n
    \n
  1. Go to https://ipinfo.io
    2. \n
  2. Enter the IP address in the search box
    3. \n
  3. Record: City, Region, Country, Organization, ASN
    4. \n
\n

API:

\n
curl \"https://ipinfo.io/{IP_ADDRESS}?token={YOUR_TOKEN}\"
\n

Record the following fields:

\n\n

2. Query ip-api.com

\n

Web interface:

\n
    \n
  1. Go to http://ip-api.com
    2. \n
  2. The IP appears in the URL; modify to: http://ip-api.com/json/{IP_ADDRESS}
    3. \n
  3. Record: City, Region, Country, ISP, AS
    4. \n
\n

API:

\n
curl \"http://ip-api.com/json/{IP_ADDRESS}\"
\n

Record the following fields:

\n\n

3. Query VirusTotal (optional but recommended)

\n

Web interface:

\n
    \n
  1. Go to https://virustotal.com
    2. \n
  2. Click “Search” and enter the IP address
    3. \n
  3. Go to the “Details” tab
    4. \n
  4. Record: Country, ASN, Network
    5. \n
\n

API:

\n
curl --header \"x-apikey: {YOUR_API_KEY}\" \\\n  \"https://www.virustotal.com/api/v3/ip_addresses/{IP_ADDRESS}\"
\n

Record from data.attributes:

\n\n

4. Check for VPN/Proxy/Tor

\n

This step determines whether the IP is masking its true origin.

\n

4a. Check ip-api.com flags

\n

If you queried ip-api.com in Step 2, check these additional fields in the response:

\n\n

API (with extra fields):

\n
curl \"http://ip-api.com/json/{IP_ADDRESS}?fields=status,country,city,isp,as,proxy,hosting\"
\n

4b. Check AbuseIPDB

\n

Web interface:

\n
    \n
  1. Go to https://abuseipdb.com
    2. \n
  2. Enter the IP address
    3. \n
  3. Look for: Usage Type, ISP, and “Is Tor” flag
    4. \n
\n

API:

\n
curl -G \"https://api.abuseipdb.com/api/v2/check\" \\\n  --data-urlencode \"ipAddress={IP_ADDRESS}\" \\\n  -H \"Key: {YOUR_API_KEY}\" \\\n  -H \"Accept: application/json\"
\n

Record from response:

\n\n

4c. Check Tor Exit Node List

\n

Manual check:

\n
    \n
  1. Download the list: https://check.torproject.org/torbulkexitlist
    2. \n
  2. Search for the IP address in the file
    3. \n
  3. If found, the IP is a known Tor exit node
    4. \n
\n

Command line:

\n
curl -s \"https://check.torproject.org/torbulkexitlist\" | grep -q \"{IP_ADDRESS}\" && echo \"TOR EXIT NODE\" || echo \"Not a Tor exit\"
\n

Summary: Privacy/Anonymization Flags

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
CheckResult
ip-api proxy flag
ip-api hosting flag
AbuseIPDB usageType
AbuseIPDB isTor
Tor exit node list
\n

Interpretation:

\n\n

Validation

\n

Compare the results from each source:

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
FieldIPinfo.ioip-api.comVirusTotal
Country
City/Region
ASN/Org
\n

Validation checks:

\n
    \n
  1. \n

    Country match: Do all sources agree on the country?

    \n\n
    2. \n
  2. \n

    City/Region match: Do at least 2 sources agree on city or region?

    \n\n
    3. \n
  3. \n

    ASN/Org match: Do the ASN numbers match?

    \n\n
    4. \n
\n

Known limitations:

\n\n

Output

\n

Produce a summary in this format:

\n
IP Address: {IP}\nLookup Date: {YYYY-MM-DD}\n\nLocation:\n  Country: {country} (confidence: high/medium/low)\n  City/Region: {city, region} (confidence: high/medium/low)\n\nNetwork:\n  ASN: {asn}\n  Organization: {org name}\n\nPrivacy/Anonymization:\n  Tor Exit Node: {yes/no}\n  Proxy/VPN Detected: {yes/no/unknown}\n  Hosting/Datacenter: {yes/no}\n  ⚠️ Location Reliability: {reliable / unreliable - anonymized}\n\nValidation:\n  Sources queried: {list sources}\n  Country consensus: {yes/no}\n  City consensus: {yes/no}\n\nNotes:\n  {any discrepancies or flags}
\n

Important: If any privacy/anonymization flag is positive, add a warning that the geolocation data represents the proxy/VPN/Tor endpoint, NOT the actual user location.

\n

Logging

\n

Record the following in your investigation log or ticket:

\n
    \n
  1. The IP address queried
    2. \n
  2. Date/time of lookup
    3. \n
  3. Sources consulted
    4. \n
  4. Location results: Country, City/Region, confidence level
    5. \n
  5. Network info: ASN, Organization
    6. \n
  6. Privacy flags: Tor, Proxy/VPN, Hosting/Datacenter
    7. \n
  7. Location reliability assessment
    8. \n
  8. Any discrepancies noted
    9. \n
  9. Analyst name or “automated” if run by script
    10. \n
\n

Example log entry:

\n
[2026-01-01 14:30] GeoIP lookup for 203.0.113.42\nSources: IPinfo.io, ip-api.com, VirusTotal, AbuseIPDB, Tor list\nResult: Netherlands, Amsterdam (high confidence)\nASN: AS12345 - Example Hosting Inc.\nPrivacy: Not Tor, no proxy detected, hosting=yes (datacenter IP)\nNotes: All geo sources agree. Datacenter IP suggests server or VPN endpoint.\nAnalyst: AJ
\n

Automation Notes

\n

This playbook is a good candidate for scripting because:

\n\n

A script should:

\n
    \n
  1. Accept IP as input
    2. \n
  2. Query all configured sources
    3. \n
  3. Compare results automatically
    4. \n
  4. Output the summary format above
    5. \n
  5. Flag discrepancies for human review
    6. \n
", "links": [ "https://ipinfo.io", "http://ip-api.com", "https://virustotal.com", "https://abuseipdb.com", "https://check.torproject.org/torbulkexitlist" ], "alternates": { "html": "https://ajvanbeest.com/playbooks/geoip-lookup/", "markdown": "https://ajvanbeest.com/playbooks/geoip-lookup.md", "json": "https://ajvanbeest.com/playbooks/geoip-lookup.json" } }