ip2geo Lookup

About ip2geo.org

Why This Exists

Ever been on the wrong end of a distributed probe hammering away at your email server, SSH port, or some other exposed service? It's chaos. Logs scroll by like a waterfall, and your tools? They're powerful, sure — but not exactly friendly when you're trying to make sense of hundreds of connections in real time.

The Problem

You run a CLI command, grab the output, and paste it into your favorite text editor. You start cleaning it up, extracting IPs manually, only to hit a wall: now you're supposed to copy-paste those addresses into a web form. One by one. Seriously?

When you're facing a flood of suspicious traffic, that's just not going to cut it.

The Fix

I was maintaining an aging email system with no password policies and no support — a perfect storm for account compromises. With no time or budget to overhaul it, I built this tool instead.

ip2geo.org lets you paste raw output from tools like netstat, fail2ban, or anything else that spits out IPs. It automatically extracts valid IPv4 addresses, runs a fast geolocation lookup, and gives you clean, actionable data — instantly. With one glance, I could see login attempts from every corner of the globe and quickly block entire botnets.

What It's Grown Into

The free lookup is still here. But over time, ip2geo.org has grown into something more complete. When a lookup shows a high concentration of scanning or proxy infrastructure, you can now generate a full Threat Report — AbuseIPDB verification for your top IPs, ASN CIDR ranges for resilient blocking, and ready-to-run scripts for iptables, ufw, and nginx.

There's also a Community Block List — a rolling 7-day feed of CIDR ranges reported by opted-in ip2geo users. If you contribute your report, your data joins the aggregate anonymously. If you just want the list, download it and apply it directly to your firewall.

How It Works

Paste any block of text. ip2geo.org scans it for IPv4 addresses, checks them against a geolocation database, and returns results you can filter by country or infrastructure category — scanning ranges, cloud exit nodes, VPN and proxy infrastructure, or residential traffic. Want to only see scanning infrastructure hits from outside the US? Done. Focus only on what matters.

Why It's Free

This tool was built using free and open-source resources, and it's free because I wish something like this had existed when I needed it most. If it helps you too, consider buying me a coffee or tossing a few bucks toward hosting costs.