Analysts opening an attacker IP asked two questions the page could not answer:
where is this from, and is it already blocked.

Origin comes from a new IpGeolocator (ipinfo.io, cached 30 days since an IP's
location effectively never changes). Failures degrade to null rather than
throwing — origin is context, not a render dependency — and private ranges are
answered locally instead of being sent to a third party.

Block status distinguishes dry-run from enforced. The Decision Engine records a
block decision even when enforcement is off, so a row in nawasara_ip_blocks is
not proof traffic is being stopped; showing both as 'blocked' would tell an
analyst the threat is handled when it is not.

Also corrects the digest config comment: 'at' follows SECSCAN_DIGEST_TIMEZONE,
not the server clock.