Playbook: Find the Geolocation of an External IP Address

Evergreen5 min read

Purpose

Determine the geographic location of an external IP address using multiple sources, and validate that the results are consistent.

Required Tools & Access

Tool Access Needed Free Tier? Notes
IPinfo.io API token or web interface Yes (50k/month) Privacy detection requires paid plan
ip-api.com No auth for non-commercial Yes Includes proxy/hosting flags
VirusTotal API key or web interface Yes (limited)
AbuseIPDB API key or web interface Yes (1k/day) Tor/proxy detection
Tor Exit Node List None Yes Official Tor Project list

You need at least two geolocation sources to cross-validate results.

Input

  • One external IPv4 or IPv6 address (e.g., 8.8.8.8)

Steps

1. Query IPinfo.io

Web interface:

  1. Go to https://ipinfo.io
  2. Enter the IP address in the search box
  3. Record: City, Region, Country, Organization, ASN

API:

curl "https://ipinfo.io/{IP_ADDRESS}?token={YOUR_TOKEN}"

Record the following fields:

  • city
  • region
  • country
  • org
  • asn

2. Query ip-api.com

Web interface:

  1. Go to http://ip-api.com
  2. The IP appears in the URL; modify to: http://ip-api.com/json/{IP_ADDRESS}
  3. Record: City, Region, Country, ISP, AS

API:

curl "http://ip-api.com/json/{IP_ADDRESS}"

Record the following fields:

  • city
  • regionName
  • country
  • isp
  • as

Web interface:

  1. Go to https://virustotal.com
  2. Click “Search” and enter the IP address
  3. Go to the “Details” tab
  4. Record: Country, ASN, Network

API:

curl --header "x-apikey: {YOUR_API_KEY}" \
  "https://www.virustotal.com/api/v3/ip_addresses/{IP_ADDRESS}"

Record from data.attributes:

  • country
  • asn
  • as_owner

4. Check for VPN/Proxy/Tor

This step determines whether the IP is masking its true origin.

4a. Check ip-api.com flags

If you queried ip-api.com in Step 2, check these additional fields in the response:

  • proxy: true/false (detects proxy/VPN)
  • hosting: true/false (datacenter/hosting provider, often indicates VPN)

API (with extra fields):

curl "http://ip-api.com/json/{IP_ADDRESS}?fields=status,country,city,isp,as,proxy,hosting"

4b. Check AbuseIPDB

Web interface:

  1. Go to https://abuseipdb.com
  2. Enter the IP address
  3. Look for: Usage Type, ISP, and “Is Tor” flag

API:

curl -G "https://api.abuseipdb.com/api/v2/check" \
  --data-urlencode "ipAddress={IP_ADDRESS}" \
  -H "Key: {YOUR_API_KEY}" \
  -H "Accept: application/json"

Record from response:

  • data.usageType (e.g., “Data Center/Web Hosting/Transit”)
  • data.isTor (true/false)
  • data.totalReports (abuse report count)

4c. Check Tor Exit Node List

Manual check:

  1. Download the list: https://check.torproject.org/torbulkexitlist
  2. Search for the IP address in the file
  3. If found, the IP is a known Tor exit node

Command line:

curl -s "https://check.torproject.org/torbulkexitlist" | grep -q "{IP_ADDRESS}" && echo "TOR EXIT NODE" || echo "Not a Tor exit"

Summary: Privacy/Anonymization Flags

Check Result
ip-api proxy flag
ip-api hosting flag
AbuseIPDB usageType
AbuseIPDB isTor
Tor exit node list

Interpretation:

  • Tor exit node: Location data is meaningless; this is the exit point, not the user
  • Proxy/VPN detected: Location may be the VPN endpoint, not the user
  • Hosting/Datacenter: Likely a server, VPN endpoint, or automated traffic—not a typical end user

Validation

Compare the results from each source:

Field IPinfo.io ip-api.com VirusTotal
Country
City/Region
ASN/Org

Validation checks:

  1. Country match: Do all sources agree on the country?

    • If YES: High confidence in country-level location
    • If NO: Flag discrepancy; IP may use anycast or be misattributed

  2. City/Region match: Do at least 2 sources agree on city or region?

    • If YES: Reasonable confidence in city-level location
    • If NO: Report country only; city-level data is unreliable for this IP

  3. ASN/Org match: Do the ASN numbers match?

    • If YES: Confirms the network owner
    • If NO: Investigate further; one source may have stale data

Known limitations:

  • VPNs, proxies, and Tor exit nodes will show the endpoint location, not the user (Step 4 helps detect these)
  • CDN and anycast IPs (e.g., Cloudflare, Google) may return multiple valid locations
  • Mobile IPs may geolocate to carrier headquarters, not actual user location
  • Privacy detection is not perfect; some VPNs use residential IPs that evade detection

Output

Produce a summary in this format:

IP Address: {IP}
Lookup Date: {YYYY-MM-DD}

Location:
  Country: {country} (confidence: high/medium/low)
  City/Region: {city, region} (confidence: high/medium/low)

Network:
  ASN: {asn}
  Organization: {org name}

Privacy/Anonymization:
  Tor Exit Node: {yes/no}
  Proxy/VPN Detected: {yes/no/unknown}
  Hosting/Datacenter: {yes/no}
  ⚠️ Location Reliability: {reliable / unreliable - anonymized}

Validation:
  Sources queried: {list sources}
  Country consensus: {yes/no}
  City consensus: {yes/no}

Notes:
  {any discrepancies or flags}

Important: If any privacy/anonymization flag is positive, add a warning that the geolocation data represents the proxy/VPN/Tor endpoint, NOT the actual user location.

Logging

Record the following in your investigation log or ticket:

  1. The IP address queried
  2. Date/time of lookup
  3. Sources consulted
  4. Location results: Country, City/Region, confidence level
  5. Network info: ASN, Organization
  6. Privacy flags: Tor, Proxy/VPN, Hosting/Datacenter
  7. Location reliability assessment
  8. Any discrepancies noted
  9. Analyst name or “automated” if run by script

Example log entry:

[2026-01-01 14:30] GeoIP lookup for 203.0.113.42
Sources: IPinfo.io, ip-api.com, VirusTotal, AbuseIPDB, Tor list
Result: Netherlands, Amsterdam (high confidence)
ASN: AS12345 - Example Hosting Inc.
Privacy: Not Tor, no proxy detected, hosting=yes (datacenter IP)
Notes: All geo sources agree. Datacenter IP suggests server or VPN endpoint.
Analyst: AJ

Automation Notes

This playbook is a good candidate for scripting because:

  • All steps are deterministic
  • APIs return structured data
  • Validation logic is straightforward

A script should:

  1. Accept IP as input
  2. Query all configured sources
  3. Compare results automatically
  4. Output the summary format above
  5. Flag discrepancies for human review
This page asmarkdownjson

Comments