GeoOpen And MMDB-Server: An Open Source Solution For IP Address Geoloc.

The talk starts from a common pain point in threat intelligence work: IP geolocation data. Commercial sources often require registration and payment, and historical records are usually locked behind paid tiers. Many analysts instead turn to public lookup websites, which means they hand over the addresses they are investigating. Forensic work makes this worse, because an address's location can change over months or a year, so older geolocation data is often needed.

The speaker introduces GeoOpen, a free geolocation database distributed in the MaxMind DB format. Because that format is open, the files can be read by existing tools, and users can also build their own files from their own sources. The project refreshes its data daily and publishes historical snapshots of both location and network ownership data for download. Alongside the data, the MMDB-Server project offers an open source server that loads these files and answers lookups through an API. It has integrations for MISP and other tools, and it returns location and historical records for an address. Because it runs locally, queries stay off the internet and responses are fast. A public lookup service runs the same code for people who prefer not to host anything. The lookups cover both IPv4 and IPv6.

The practical takeaway is that teams can replace ad hoc lookup websites and paid historical feeds with a local, open data source that is easy to version and swap into MaxMind-compatible workflows.