IPGeolocation.io Steampipe Plugin

1. ipgeolocation_ip

This is the main table. It returns geolocation, network, timezone, company, security, abuse, and hostname data for any IP address.

Required filter: WHERE ip = '<address>'

Key columns:

Example:

select
  ip,
  country_name,
  city,
  company_name,
  timezone_name,
  is_vpn,
  threat_score
from
  ipgeolocation_ip
where
  ip = '1.1.1.1';

2. ipgeolocation_security

Returns threat intelligence signals for an IP address. This includes VPN, proxy, Tor, relay, bot, and spam detection along with a composite threat score.

Required filter: WHERE ip = '<address>'

Key columns:

Example:

select
  ip,
  is_vpn,
  is_proxy,
  is_tor,
  is_bot,
  threat_score,
  is_residential_proxy
from
  ipgeolocation_security
where
  ip = '185.220.101.1';

3. ipgeolocation_abuse

Returns the abuse contact information for an IP address. This is the contact details registered with the relevant Regional Internet Registry (RIR) for reporting abuse.

Required filter: WHERE ip = '<address>'

Key columns:

Example:

select
  ip,
  abuse_email,
  abuse_phone,
  organization,
  network
from
  ipgeolocation_abuse
where
  ip = '192.0.2.1';

4. ipgeolocation_asn

Returns Autonomous System Number (ASN) details for an IP address, including routing information, peers, upstreams, downstreams, and WHOIS data.

Required filter: WHERE ip = '<address>'

Key columns:

Example:

select
  ip,
  as_number,
  organization,
  country,
  type,
  domain
from
  ipgeolocation_asn
where
  ip = '8.8.8.8';

1. Look up basic geolocation for a single IP

select
  ip,
  country_name,
  country_code2,
  city,
  latitude,
  longitude,
  timezone_name
from
  ipgeolocation_ip
where
  ip = '8.8.8.8';

2. Check whether an IP is behind a VPN or proxy

select
  ip,
  is_vpn,
  is_proxy,
  is_tor,
  is_relay,
  vpn_provider_names,
  threat_score
from
  ipgeolocation_security
where
  ip = '104.28.0.1';

3. Get the ISP and network details for an IP

select
  ip,
  company_name,
  organization,
  asn,
  country_name,
  city
from
  ipgeolocation_ip
where
  ip = '203.0.113.10';

4. Find the abuse contact for a suspicious IP

select
  ip,
  abuse_email,
  abuse_phone,
  organization,
  network
from
  ipgeolocation_abuse
where
  ip = '198.51.100.5';

5. Look up ASN routing details

select
  ip,
  as_number,
  asn_name,
  organization,
  type,
  domain,
  country
from
  ipgeolocation_asn
where
  ip = '1.1.1.1';

6. Filter by country code

select
  ip,
  country_name,
  city
from
  ipgeolocation_ip
where
  ip = '103.21.244.0'
  and country_code2 = 'AU';

7. Check high-risk signals across multiple IPs using a subquery

Steampipe supports querying a list of IPs by using a UNION ALL subquery:

select
  ip,
  is_vpn,
  is_tor,
  threat_score
from
  ipgeolocation_security
where
  ip in (
    select ip from (values
      ('185.220.101.1'),
      ('45.142.212.100'),
      ('195.154.122.36')
    ) as t(ip)
  );

1. Log Enrichment for Security Teams

Security engineers frequently need to enrich raw server logs with geolocation and threat context before investigating alerts. Instead of building a Python script that loops over IPs and calls the API, you can use Steampipe to pull location and threat signals alongside your internal log data.

Scenario: You have a list of login attempt source IPs from a failed authentication spike and want to quickly understand their geography and threat posture.

-- Enrich a known suspicious IP from your logs
select
  g.ip,
  g.country_name,
  g.city,
  g.company_name,
  g.organization,
  s.is_vpn,
  s.is_proxy,
  s.is_tor,
  s.threat_score,
  a.emails
from
  ipgeolocation_ip g
  join ipgeolocation_security s on g.ip = s.ip
  join ipgeolocation_abuse a on g.ip = a.ip
where
  g.ip = '185.220.101.1';

In a single query you get the country, the ISP, VPN and Tor flags, a threat score, and the abuse email you would use to file a report, all from one row. No API wrapper code needed.

2. Threat Triage for SOC Analysts

When working a security incident, analysts often need to triage a list of IPs quickly. This use case shows how to enrich a set of IPs flagged by your SIEM or IDS.

Scenario: Your intrusion detection system flagged five IPs in the last 24 hours. You need to know if any of them are Tor nodes or known VPN exit points before escalating.

select
  ip,
  is_vpn,
  is_tor,
  is_bot,
  is_spam,
  threat_score,
  vpn_provider_names
from
  ipgeolocation_security
where
  ip = '91.108.4.1'

union all

select
  ip,
  is_vpn,
  is_tor,
  is_bot,
  is_spam,
  threat_score,
  vpn_provider_names
from
  ipgeolocation_security
where
  ip = '149.154.160.1';

Sort by threat_score descending to prioritize the most suspicious IPs first.

3. Compliance Audits for Restricted Jurisdictions

If your service has geographic access restrictions (sanctions compliance, licensing rules, or regional regulations), you can use Steampipe to audit specific IPs and confirm whether they fall inside or outside permitted regions.

Scenario: Your compliance team wants to verify that a set of IPs that accessed your platform do not originate from sanctioned countries.

select
  ip,
  country_name,
  country_code2,
  city,
  organization
from
  ipgeolocation_ip
where
  ip = '78.40.124.1'
  and country_code2 not in ('RU', 'KP', 'IR', 'SY', 'CU');

If the query returns no rows, the IP is from a restricted country. You can adapt this into a larger compliance report by joining against a table of access logs.

4. Infrastructure Inventory and Network Mapping

DevOps and network teams can use the ASN table to map out the ownership and routing of IPs across their cloud infrastructure or third-party vendor networks.

Scenario: You want to confirm that your CDN IPs are all originating from the expected ASN before pushing a firewall rule.

select
  ip,
  as_number,
  asn_name,
  organization,
  type,
  domain,
  country
from
  ipgeolocation_asn
where
  ip = '104.21.0.1';

Use the type field to distinguish between hosting provider IPs ( HOSTING ), ISP IPs ( ISP ), education networks ( EDUCATION ), and enterprise allocations ( ENTERPRISE ).

5. Abuse Reporting Workflow

When you detect malicious traffic from an IP, you need to report it to the right abuse contact. This query gives you everything needed to file a report: the IP's network block, the abuse email, and the responsible organization.

select
  ip,
  organization,
  network,
  emails,
  phone_numbers,
  country
from
  ipgeolocation_abuse
where
  ip = '45.142.212.100';

The network column returns the CIDR block that the IP belongs to, which is useful when you want to report or block the entire range rather than just the single address.

6. Timezone Routing for Scheduled Jobs

If you are building a scheduling system that needs to assign jobs based on a user's timezone, you can query the timezone data for their IP.

select
  ip,
  country_name,
  city,
  timezone_name,
  latitude,
  longitude
from
  ipgeolocation_ip
where
  ip = '202.12.29.1';

The timezone_name column returns a valid IANA timezone string that you can pass directly to your application's time handling library.