IP2Location

IP2Location

Warning

Local Databases Required: This module performs intelligence gathering completely locally and offline. It strictly requires the presence of local database files (BIN format) in your database directory. If no databases are found at startup, the module simply will not return its functions for selection. For instructions on downloading these files, refer to Offline Datasets, and for configuration paths, refer to Global Settings.

The IP2Location module provides ultra-fast, offline enrichment of IP addresses. It does not send any network requests, making it completely stealthy. Depending on which local .BIN databases you provide, the module dynamically unlocks up to three distinct reconnaissance functions.

Data Source: IP2Location

Capabilities

Note

The breadth and depth of the intelligence extracted by this module directly depends on the specific database tier you have downloaded. Commercial (Premium) databases contain significantly more data points than the free LITE versions. Fields that are not present in your specific database will simply be skipped.

The module accepts IPv4 and IPv6 nodes as input. Its capabilities are split into three distinct categories based on the databases you have downloaded:

1. Geo-Location & ISP Intelligence

When the geographical database is present, the module extracts profound geographic and carrier data:

• Deep Geography: Generates a unified Geo property containing City, District, Region, Country (short and long), exact Latitude/Longitude, Zipcode, Timezone, and Elevation.
• Network Ownership: Extracts the precise ISP operating the network.
• Reverse IP: Identifies the primary Domain associated with the IP address (often the hosting provider), automatically marking it with the Reverse IP tag.
• Network Context: Extracts the network Usage Type (e.g., Commercial, ISP, Data Center), Connection Speed, Address Type, and IAB Category.
• Mobile Networks: If the IP belongs to a cellular network, it extracts the Mobile Network details, including the Mobile Brand, MCC (Mobile Country Code), and MNC (Mobile Network Code).

2. Autonomous System Intelligence

When the autonomous system (ASN) database is present, the module maps IPs to the global BGP routing tables:

• Autonomous System: Extracts the ASN node (e.g., AS15169).
• AS Metadata: Extracts the official Organization (AS Owner) and the primary Domain registered to the AS, tagging the domain as Linked.
• Routing Blocks: Extracts the exact CIDR block encompassing the target IP.
• Usage: Classifies the AS Usage Type.

3. Proxy & Threat Detection

Note

If you are using the free LITE version of the Proxy database, this function will only be available for IPv4 nodes. The premium version unlocks IPv6 support.

When the proxy database is present, the module scans IPs against known anonymity networks and malicious infrastructure. If the IP is identified as a proxy, it extracts:

• Anonymity Profiling: Automatically assigns high-value behavioral tags based on the proxy type: VPN, Tor Exit, Proxy (Public/Web), Data Center, Crawler, AI Crawler, Residential Proxy, or Privacy Network.
• Threat Classification: If the IP is associated with malicious activity, it emits threat tags: Scanner, Spam Botnet, Spam, or Bogon.
• Risk Scoring: Emits a Fraud Score (Abuse Score).
• Timestamps: Extracts a Last Seen property indicating how many days ago the IP was actively observed acting as a proxy.
• Attribution: Identifies the VPN/Proxy Provider by name and extracts their associated Domain (tagged as Reverse IP).
• Usage Context: Extracts the specific Proxy Usage Type.