Local-first IP infrastructure intelligence

GEOIP FORENSICS CONSOLE

A desktop GeoIP, RDAP, WHOIS, ASN clustering, and confidence-scoring workstation for investigators who need fast answers without spraying sensitive lookups into the cloud.

Install Console View Capabilities
GeoLite2 MMDB RDAP / WHOIS Tor Exit Heuristics ASN Clustering
geoip_forensics_gui :: v1.1.0
target_ip = 203.0.113.42RUN ALL
Confidence86%
ASN ClusterAS64496
RIR MatchAligned
Tor FlagsNone
✓ GeoIP city/country/asn resolved
✓ RDAP-lite ownership summarized
✓ WHOIS raw evidence captured
✓ Batch cluster CSV ready for export

Investigation Capabilities

GEOIP Forensics Console turns IP addresses into structured evidence by combining local MaxMind databases, RDAP/WHOIS ownership data, CIDR context, and an interpretation layer built for practical network investigation.

IP

GeoIP Lookup

Use local City, Country, and ASN MMDB databases to resolve geography, network ownership, timezone, and accuracy radius.

RD

RDAP & WHOIS

Pull CIDR, RIR registry, ASN country, descriptions, net records, contacts, and raw WHOIS output for evidence review.

AS

ASN Clustering

Batch mode groups observed IPs by ASN, highlights country divergence, and exports cluster-level CSV summaries.

Analysis Layer

The v1.1.0 interpretation layer helps separate clean infrastructure from suspicious or inconsistent routing evidence.

▣Tor exit-node heuristics: offline-friendly matching using an optional local Tor exit list at assets/tor_exit_nodes.txt.
▣Confidence scoring: compares GeoIP, ASN, and RIR country agreement to produce an explainable confidence rating.
▣Batch exports: produce both per-IP CSV output and ASN cluster CSV output for larger investigations.
▣Report artifacts: export JSON and human-readable text reports into a local reports directory.

Requirements & Setup

GEOIP Forensics is a local-first binary. No external services are required — however, you must supply your own GeoIP databases to enable intelligence features.

systemrequirements
# Linux (tested on Ubuntu / Debian)
sudo apt update

# Optional but recommended (WHOIS support)
sudo apt install whois
geoipdatabase setup
# 1. Create a free MaxMind account
https://www.maxmind.com/en/geolite2/signup

# 2. Download GeoLite2 databases
- GeoLite2-City.mmdb
- GeoLite2-Country.mmdb
- GeoLite2-ASN.mmdb

# 3. Extract and place them anywhere on your system
~/geoip/GeoLite2-City.mmdb
~/geoip/GeoLite2-Country.mmdb
~/geoip/GeoLite2-ASN.mmdb

# 4. Launch GEOIP Forensics and configure paths
#    → Databases tab → Browse → Select each .mmdb file
runbinary
# Make executable (if needed)
chmod +x geoip_forensics

# Launch
./geoip_forensics

No cloud. No telemetry. No external dependencies.
All intelligence is derived locally from your provided datasets.

Download

Deploy the GEOIP Forensics Console locally. No installers, no dependencies, no telemetry.

Latest Release

OS: Linux (Binary)
Version: 1.1.0
File Size: 14.9 MB
DOWNLOAD
GEOIP Forensics Icon

Local-First by Design

The workstation is built for operators who want visibility without unnecessary leakage. GeoIP database lookups run locally, reports are written locally, and optional Tor exit-node checks use a local text corpus.

DB

Local MMDB

City, Country, and ASN lookups can run directly against your local GeoLite2 database files.

CSV

Portable Evidence

Export report JSON, readable text, per-IP batch CSV, and ASN cluster CSV for case notes or downstream analysis.

⊕

Explainable Signals

Confidence and flags are surfaced as visible signals, not magic verdicts from a sealed black box.