Enrich every log, event, and alert with location and network attribution — the context detections and analysts need.
Security platforms don't just need an IP — they need to know where and whose network it is. IP geolocation enriches logs, alerts, and events with country, ASN, and basic risk context, so detections and analysts have the origin story behind every request.
From everyday log enrichment to anomaly detection and third-party monitoring.
Attach country, region, and ASN to every log line, auth event, and API call so your platform can reason about where activity originates — not just the raw IP.
Auth log → 77.75.x.x
country: Czechia · asn_org: Seznam → geo-tagged event in the timeline
Resolve ASN, organisation, and connection type to tell corporate, residential, hosting, and cloud traffic apart when triaging an incident or profiling an endpoint.
Inbound → 3.120.x.x
asn_org: Amazon · type: hosting → classified as cloud infrastructure
Compare the location of consecutive sessions for the same identity. Two distant countries minutes apart is a classic account-takeover signal worth flagging.
Session A: Berlin → Session B: Lagos (4 min)
impossible travel → raise anomaly, trigger re-auth
Feed country, hosting-ASN, and basic VPN/Tor/threat flags into detection rules so analysts see where and how a request reached a system that AI agents and integrations touch.
Alert → security.isTor: true · ASN: hosting
Tor + datacentre origin → elevated alert severity
For platforms watching SaaS, cloud, and homegrown integrations, geo and network data show which regions and providers are reaching sensitive endpoints over time.
API token used → 20.50.x.x
country: Ireland · asn_org: Microsoft → expected region, baseline OK
Every one of these ships in the standard response — no add-ons, no tiers.
country / region / city Geo-tagging events, logs, and alerts connection (ASN / org / type) Network attribution: corporate / hosting / cloud security (isVpn / isTor / isThreat) Basic anonymiser and threat-level signals latitude / longitude Impossible-travel and distance checks is_in_eu Regional context for compliance-aware monitoring As an enrichment layer. Every IP in a log, alert, or event gets country, region, ASN, and basic risk flags attached, so detections and analysts can reason about origin and network type instead of a bare address. It feeds rules and risk scores rather than making verdicts alone.
ASN number, organisation, ISP, and connection type — enough to distinguish corporate, residential, hosting, and cloud traffic. That distinction is central to triaging incidents and profiling which providers reach sensitive systems and integrations.
It supplies the location and network signals that account-takeover detection depends on — impossible travel between sessions, logins from hosting networks, or anonymiser flags. Combine these with device and behavioural signals for a complete picture.
Free tier: 2,000 lookups/day, no card. Paid plans from $2.50/month. Bulk endpoint available for backfilling events at scale.