Geo + ASN enrichment

What it is

Every IP your scanner sees gets enriched against an offline GeoIP database. No third-party API call (no per-lookup cost, no rate limit, no PII shipped to a vendor).

What it produces

Per host:

• country (full name) + country_code (ISO-2)
• region (state / province)
• city
• latitude / longitude (for the map view)
• asn (e.g. AS13335)
• as_org (e.g. Cloudflare)
• is_hosting boolean: true when the ASN is a known cloud / hosting / CDN provider

What to use it for

• Geographic surface roll-ups: how much of our exposure is in the EU vs the US
• Hosting-provider filters: “every service we have on Hetzner” / “everything on Cloudflare we forgot to put behind a WAF”
• ASN pivots: find every service sharing an upstream with a known compromised provider
• A live geo map of your fleet (useful for board decks)

Why it matters

When a security team has 50,000 hosts under management, geography and provider grouping are the fastest way to slice the surface for a focused audit. “All databases in Frankfurt that don’t go through our VPN” is one filter away; without geo, it’s a multi-day spelunk.

Why it’s valuable

• Nothing is looked up over the network. Enrichment reads a local copy of the DB-IP Lite database, so an IP you scan is never sent to a geolocation API. That matters most when your scope includes internal ranges you would rather not hand to a third party.
• Zero ongoing cost. Free on all plans, no enrichment quota.
• Always on. Every scan is enriched, including the free tier. There is nothing to configure and no key to supply.

How to use it

Filter via SmartSearch on the Hosts or Services view:

country:DE                    # everything in Germany
as_org:"Hetzner"              # all hetzner hosts
hosting:false                 # non-cloud (likely on-prem)
city:"Frankfurt am Main"      # city granularity

Or open the Hosts → Map view for a globe rendering of your fleet.