MaxMind

MaxMind

Warning

Local Databases Required: This module performs intelligence gathering completely locally and offline. It strictly requires the presence of local database files (MMDB format) in your database directory. If no databases are found at startup, the module simply will not return its functions for selection. For instructions on downloading these files, refer to Offline Datasets, and for configuration paths, refer to Global Settings.

The MaxMind module provides ultra-fast, offline enrichment of IP addresses. It does not send any network requests, making it completely stealthy. Depending on which local .mmdb databases you provide, the module dynamically unlocks specific reconnaissance functions.

Data Source: MaxMind

Capabilities

Note

The breadth and depth of the intelligence extracted by this module directly depends on the specific database tier you have downloaded. Commercial databases contain significantly more data points than the free versions. Fields that are not present in your specific database will simply be skipped.

The module accepts IPv4 and IPv6 nodes as input. Its capabilities are split into distinct categories based on the databases you have downloaded:

1. Enterprise Intelligence

If you possess the flagship Enterprise database, the module unlocks a unified, deep-enrichment capability that processes all aspects of the IP in a single pass. It extracts:

• Deep Geography: Generates a unified Geo property containing City, Region, Continent, Country, Registered Country, exact Latitude/Longitude, Postal Code, Timezone, and Accuracy Radius.
• Geographical Confidence: Emits precise confidence scores (0-100) indicating the accuracy of the City, Country, Postal, and Region data.
• Network & ISP: Extracts the specific ISP and corporate Organization operating the IP block, along with ASN and ASN Organization.
• Behavioral Traits: Extracts the Connection Type (e.g., Cellular, Broadband) and network User Type (e.g., Business, College, Residential).
• IP Velocity: Calculates a Static IP Score, profiling whether the IP is highly dynamic, dynamic, or purely static.
• Reverse IP: Identifies the primary Domain associated with the IP address, automatically marking it with the Reverse IP tag.

2. Geo-Location Intelligence

When the City database is present, the module extracts:

• Geography: Generates a unified Geo property containing City, Region, Continent, Country, Registered Country, exact Latitude/Longitude, Postal Code, Timezone, and Accuracy Radius.

3. Autonomous System Intelligence

When the ASN or ISP database is present, the module maps IPs to the global BGP routing tables:

• Autonomous System: Extracts the ASN node (e.g., AS15169).
• AS Metadata: Extracts the official Organization (AS Owner) and the ASN Organization.
• Network Ownership: Extracts the precise ISP.

4. Proxy & Threat Detection

When the proxy database is present, the module scans IPs against known anonymity networks and malicious infrastructure. If the IP is identified as a proxy, it extracts:

• Anonymity Profiling: Automatically assigns high-value behavioral tags based on the proxy type: VPN, Tor Exit, Proxy, Data Center, or Residential Proxy.
• Risk Scoring: Emits an Anonymizer Confidence Score.
• Timestamps: Extracts a Last Seen property indicating when the IP network was last observed acting as a proxy.
• Attribution: Identifies the VPN/Proxy Provider by name.