Geo + ASN enrichment

What it is

Every IP your scanner sees gets enriched against an offline GeoIP database. No third-party API call (no per-lookup cost, no rate limit, no PII shipped to a vendor).

What it produces

Per host:

• country (full name) + country_code (ISO-2)
• region (state / province)
• city
• latitude / longitude (for the map view)
• asn (e.g. AS13335)
• as_org (e.g. Cloudflare)
• is_hosting boolean: true when the ASN is a known cloud / hosting / CDN provider

What to use it for

• Geographic surface roll-ups: how much of our exposure is in the EU vs the US
• Hosting-provider filters: “every service we have on Hetzner” / “everything on Cloudflare we forgot to put behind a WAF”
• ASN pivots: find every service sharing an upstream with a known compromised provider
• A live geo map of your fleet (useful for board decks)

Why it matters

When a security team has 50,000 hosts under management, geography and provider grouping are the fastest way to slice the surface for a focused audit. “All databases in Frankfurt that don’t go through our VPN” is one filter away; without geo, it’s a multi-day spelunk.

Why it’s valuable

• No vendor lock-in. Offline DB-IP Lite + GeoLite2; updates ship with the binary.
• Zero ongoing cost. Free on all plans, no enrichment quota.
• Privacy-respecting. No IP leaks to a third party, relevant for customers with internal-IP scope.

How to use it

Filter via SmartSearch on the Hosts or Services view:

country:DE                    # everything in Germany
as_org:"Hetzner"              # all hetzner hosts
hosting:false                 # non-cloud (likely on-prem)
city:"Frankfurt am Main"      # city granularity

Or open the Hosts → Map view for a globe rendering of your fleet.