3 Ways an IP Geolocation API Can Help with Cybersecurity

Internet-connected devices are typically identifiable via their IP address. That usually makes IP geolocation data pertinent to various business processes, including marketing, fraud prevention, network protection, and more. 

Since IP geolocation information can tell us where pretty much everyone who communicates or accesses our network and digital assets are from, it can also help organizations strengthen their cybersecurity posture. This is probably one of the most critical applications of such data these days, given that a ransomware attack, for instance, which is just one of the many types of cyber attacks, is likely to occur every 11 seconds. 

This post lists three ways IP address information gathered with an IP geolocation API can help beef up your company’s cybersecurity.

An IP geolocation API can help you prioritize alerts.

More than half of large organizations reportedly handle more than 1,000 alerts per day. That number may sometimes be too much for any security team given that they have other tasks as well. They need a means to focus on the most important alerts, therefore, if they are to avoid alert fatigue. An IP geolocation API can come in handy for that.

Security specialists can use an IP geolocation API in tandem with a list of top threat sources. An example of such a list is Spamhaus’s 10 Worst Spam Countries, which is updated daily. Using it as a guide, security analysts can hone in on IP addresses from these countries that set off alerts first.

Let’s take a look at a concrete example. Say you were alerted to the following IP addresses:

• 98[.]196[.]94[.]89
• 222[.]128[.]48[.]197
• 5[.]188[.]206[.]205
• 80[.]3[.]133[.]146
• 172[.]91[.]31[.]219

An IP geolocation API would tell you their origin countries, which are:

• 98[.]196[.]94[.]89: U.S.
• 222[.]128[.]48[.]197: China
• 5[.]188[.]206[.]205: Bulgaria
• 80[.]3[.]133[.]146: U.K.
• 172[.]91[.]31[.]219: U.S.

The top 10 worst spam countries list for 1 August 2021 includes the U.S., China, Russia, Japan, South Korea, India, Turkey, Vietnam, Hong Kong, and the Dominican Republic. With that information, you can analyze 98[.]196[.]94[.]89, 222[.]128[.]48[.]197, and 172[.]91[.]31[.]219 first. When you have more than enough time, you can move on to the others to ensure complete protection.

An IP geolocation API can help you spot cybersecurity trends.

If you’re a security researcher who’s looking to build a top country list of threat sources, an IP geolocation API can help speed up the process so long as it allows bulk lookups, of course. Given a list of up to 100,000 malicious IP addresses, you just need to paste these onto a comma-separated values (CSV) sheet then upload it to a bulk IP geolocation API. Wait a few minutes, depending on how expansive your list is, until you’re prompted to download the results. From there, you can count the number of IP addresses by country, region/state, or city to identify cybercrime or attack hotspots.

An IP geolocation API can tell you, for instance, where the 762 identified malicious IP addresses connected to a Phorpiex Botnet extortion attack originate from. From there, you can see trends. The data, for instance, revealed that the IP addresses were distributed across 107 countries led by:

• Brazil (72 IP addresses)
• India (56 IP addresses)
• South Korea (36 IP addresses)
• Israel (29 IP addresses)
• Spain (27 IP addresses)
• Pakistan (27 IP addresses)
• Argentina (26 IP addresses)
• Portugal (25 IP addresses)
• Italy (24 IP addresses)
• South Africa (24 IP addresses)

Given those numbers, researchers can warn their product users about other IP addresses coming from the countries listed. The nations identified could be considered Phorpiex Botnet hotspots.

An IP geolocation API can boost your company’s fraud prevention efforts.

Cybersecurity requires not just protecting your network from getting breached, it also means reducing your chances of getting defrauded. IP geolocation data can also help with that. You can use an IP geolocation API in tandem with your customer database with their usual IP addresses (typically pointing to their homes or offices). If the buyer’s current IP address doesn’t match his/her recorded one/s, you can add a verification step (a confirmation call, for example) to ensure he/she is actually making the purchase and not a fraudster.

If a customer lives in the U.S. (with IP address 1[.]32[.]232[.]0) but he suddenly made a huge purchase from South Korea (based on the IP address used during the transaction 119[.]193[.]232[.]132), that should alert you to a potential instance of fraud. Given the travel restrictions these days, call the customer at home and ask if he indeed bought the item. If not, report the errant IP address to the authorities.

—
As this post showed, IP geolocation data can help organizations with alert prioritization, security trend identification, and fraud prevention. However, companies may benefit from an IP geolocation API in other ways as well, including content personalization, DRM enhancement, search engine optimization, and many more.

Ipstack is an API that creates apps which locate and identify web visitors by IP address.