IP intelligence research and data engineering

ipanalytics

Open datasets, parsers, dashboards, MMDB tooling, and automation for IP ranges, ASN metadata, GeoIP databases, VPN infrastructure, Tor relays, crawler networks, and network reputation signals.

GitHub profile Repositories

IP intelligence ASN analytics GeoIP / MMDB VPN research Tor visibility Crawler intelligence

Network datasets need provenance, repeatability, and confidence scoring.

ipanalytics focuses on practical IP intelligence systems: collecting public network metadata, normalizing inconsistent provider data, joining ASN and CIDR context, validating GeoIP/MMDB outputs, and publishing compact datasets for security, abuse, fraud, routing, crawler visibility, and infrastructure analytics workflows.

IP and ASN enrichment

Projects are built around CIDR ranges, ASN ownership, hosting and CDN context, RIR and WHOIS metadata, geofeeds, source provenance, and confidence-aware enrichment.

Infrastructure visibility

Research covers VPN, proxy, Tor, hosting, crawler, AI fetcher, cloud, CDN, scanner, and reputation signals without depending on a single opaque feed.

Operational datasets

Outputs are designed for dashboards, CSV/JSON pipelines, MMDB processing, reproducible builds, quality checks, static APIs, and downstream security workflows.

Featured projects

GeoForge Consensus GeoIP MMDB builder combining lite, public, and operator-published sources. MMDBForge Developer toolkit for inspecting, validating, diffing, and explaining MaxMind DB files. MMDB-WatchTower Production-safe updater for MMDB files with verification, atomic swaps, rollback, and metrics. IP-Knowledge-Layer Open knowledge layer for CIDR, ASN, cloud, CDN, crawler, Tor, and VPN-adjacent network context. ASN Signal Graph ASN-level infrastructure signal aggregation for VPN overlap, Tor visibility, and public feed exposure. blackroute Security intelligence pipeline for hostile IP infrastructure, abuse feeds, anonymizers, and runtime lookup data. CrawlerScope Interactive crawler IP intelligence dashboard for search, AI, monitoring, and user-triggered fetchers. Tor-Radar Static Tor relay intelligence dashboard with compact snapshots and relay metadata. VPN Infrastructure Atlas Interactive aggregate VPN infrastructure atlas by endpoint country, ASN, and hosting network. VPN Provider Overlap Aggregate VPN infrastructure overlap analysis across shared ranges, ASNs, and hosting dependencies. ASN VPN Intelligence CSV datasets generated from VPN infrastructure collection and ASN/provider analysis.

Research focus

Signals that improve network context

IP and ASN enrichment with source provenance and confidence scoring.
VPN, proxy, Tor, hosting, CDN, cloud, crawler, scanner, and reputation signal analysis.
GeoIP/MMDB processing, validation, diffing, and multi-source location consensus.
Open network intelligence datasets for security, fraud, SIEM, and routing analytics.
Dashboards and automation for repeatable IP intelligence workflows.

Data formats and stack

Built for practical pipelines

Languages and tools: Go, Python, JavaScript, HTML, Linux, Docker, GitHub Actions.
Formats: CSV, JSON, JSONL, Parquet, MMDB, CIDR lists, static APIs, and lookup indexes.
Network data: ASN, BGP, RIR delegated stats, WHOIS, GeoIP, geofeeds, and provider metadata.
Signals: VPN, proxy, Tor, crawler, cloud, CDN, hosting, scanner, abuse, and reputation.

Infrastructure ecosystem

IP enrichment layer CIDR, ASN, cloud, CDN, crawler, Tor, and VPN-adjacent context. ASN signal layer ASN-level public signal aggregation for infrastructure context and defensive analytics. GeoIP build layer Consensus-based local GeoIP database generation with quality reporting. MMDB inspection layer Validation, diffing, explanation, and developer tooling for MaxMind DB files. MMDB operations layer Safe update workflow for production MMDB deployment and monitoring. Crawler visibility layer Search, AI crawler, monitoring probe, scanner, and user-triggered fetcher visibility. Tor intelligence layer Tor relay metadata, snapshots, and static dashboard analytics. VPN atlas layer Aggregate provider footprint across countries, ASNs, and hosting networks.

Why this work matters

Transparent network intelligence is easier to audit.

Many IP intelligence feeds are useful but difficult to inspect. The ipanalytics projects prioritize clear inputs, compact outputs, source-aware scoring, reproducible update paths, and operational formats that are easy to review, compare, and integrate.

{
  "signals": [
    "asn",
    "cidr",
    "geoip",
    "vpn",
    "tor",
    "crawler",
    "reputation"
  ],
  "outputs": [
    "csv",
    "json",
    "jsonl",
    "mmdb",
    "dashboard",
    "static-api"
  ],
  "principles": [
    "source provenance",
    "confidence scoring",
    "repeatable builds",
    "quality checks",
    "operational exports"
  ]
}

Project map

MMDB-WatchTower Go · systemd · rollback · prometheus · geoip · maxmind · observability · mmdb MMDBForge Go · CLI · diff · networking · geoip · maxmind · developer tools Tor-Radar JavaScript · OSINT · Tor · data visualization · ASN · Onionoo · Tor relays IP-Knowledge-Layer Python · ASN · bot detection · fraud detection · VPN detection · IP ranges CrawlerScope Python · GitHub Pages · crawler · OSINT · WAF · open data ASN-Signal-Graph Python · infrastructure · OSINT · BGP · Tor · GeoIP · ASN · CIDR vpn-provider-overlap-intelligence Infrastructure · OSINT · VPN · cybersecurity · IP · data analysis · ASN ASN-VPN-Network-Intelligence VPN · ASN · provider-level infrastructure datasets GeoForge Go · GeoNames · geolocation · WHOIS · consensus · GeoIP · MaxMind · SypexGeo blackroute Go · botnet · Tor · cybersecurity · GeoIP · MaxMind · ASN · CIDR VPN-Infrastructure-Atlas HTML · GitHub Pages · data visualization · fraud detection · proxy detection

Collaboration

Open to dataset feedback, source suggestions, issue reports, and collaboration around IP intelligence, ASN enrichment, VPN and Tor infrastructure analysis, crawler detection, GeoIP/MMDB data quality, MMDB operations, and network security workflows.