IP Datasets (local enrichment)

Run upgrade-db-ipdata.php once to create the ip_ranges table, then import your WhoisXML data-feed files below.

📡 Fast switch — iptoasn.com TSVs

Drop ip2asn-v4.tsv and ip2country-v4.tsv in data/, then one click replaces the WhoisXML ranges and resolves every IP. iptoasn ranges don't overlap, so resolution is an index seek per IP — much faster than nested WhoisXML netblocks.

Loads WhoisXML IP Netblocks (ASN/org/netname/country) and IP Geolocation (country/region/city/lat-lon) data-feed files into a local integer-range table, so IP enrichment resolves by interval lookup in the DB — thousands/sec, no per-IP API calls. IPv4 ranges are stored as uint32. Heads-up: the full IPv4 geo feed is ~24M rows / ~5 GB — verify your MySQL quota before loading the full DB; the lite/subset feeds or netblocks-only are lighter.

Live Test Lookup

Import & Enrich

1) Upload a feed file (cPanel File Manager) into the docroot, e.g. uploads/ip_netblocks.full.jsonl.gz. 2) Import it. 3) Run local enrichment across all IP indicators.

1. Free option — iptoasn.com TSV (no key, ~7 MB, ~450k ranges):
   php import-ipdata.php file=uploads/ip2asn-v4.tsv.gz kind=netblock (ASN+org+country)
   php import-ipdata.php file=uploads/ip2country-v4.tsv.gz kind=geo (country)
   TSV is auto-detected; IPv6 (.v6) files are skipped (IPv4 range table).
2. WhoisXML .gz (city-level; via SSH/cron):
   php import-ipdata.php file=uploads/ip_netblocks.full.jsonl.gz kind=netblock
php import-ipdata.php file=uploads/geoipify_latest.jsonl.gz kind=geo
3. Uncompressed / lite (browser, auto-continues): Open Importer then pass ?file=uploads/…&kind=netblock
4. Resolve ASN / ORG / Country on all IP indicators (powers ASN & Country Intel): ▶ Resolve all IPs from local data ▶ ASN abuse contacts
5. Store full geo/netblock as enrichment records (optional): Netblocks enrich Geo enrich

Cron for daily deltas: 0 4 * * * php /home/zaptf0zdggll/public_html/threats/import-ipdata.php file=uploads/ip_netblocks.daily.jsonl.gz kind=netblock

Related: Enrichments · API Config · IP Profile · WhoisXML feed specs: Netblocks / Geolocation