← Back to all projects

IP Geolocation

IP Geolocation project screenshot

A comprehensive IP geolocation resolution platform with an interactive world map, detailed network intelligence (ASN, ISP, proxy/VPN detection, threat scores, fraud scoring), full DNS lookups (PTR, A, AAAA, MX, TXT), whois integration, and sub-100ms query performance across a GeoIP database of city, country, ASN, and proxy block tables.

Visit SiteView Source

Technology

frontendnextjsreact-18typescripttailwind
backendnodejs
databasemysql-8
toolsreact-simple-mapsplaywrightwhois

🌍 IP Geolocation Resolver & Network Intelligence Platform

Long-Form Project Summary for KNWS Showcase

IP Geolocation is a network intelligence tool that resolves any IP address or domain name into detailed geographic, organisational, and threat intelligence data, displayed alongside an interactive world map. It combines GeoIP database lookups, comprehensive DNS resolution (PTR, A, AAAA, MX, TXT records), WHOIS queries, ASN/ISP identification, proxy and VPN detection, and fraud scoring into a single, fast interface.

Built with Next.js 14, React 18, and TypeScript, the platform delivers sub-100ms query performance against a locally hosted MySQL 8 database containing city-level coordinates, country mappings, ASN ownership records, and proxy block tables. The interactive map uses react-simple-maps for a clean, zoomable world view with marker placement at the resolved coordinates.

Live at: https://iplocation.knws.co.uk GitHub: github.com/datagram1/iplocation

🚀 Project Goals

  1. Resolve any IP address to geographic coordinates with city-level accuracy, displaying results on an interactive world map.
  2. Provide comprehensive DNS lookups -- PTR, A, AAAA, MX, and TXT records for any domain or IP.
  3. Integrate WHOIS data -- registrant information, registration dates, nameservers, and registrar details.
  4. Identify the network operator -- ASN number, ISP name, organisation, and network range.
  5. Detect proxies, VPNs, and anonymisers using dedicated block-list databases.
  6. Calculate threat intelligence and fraud scores based on IP reputation data.
  7. Automatically resolve domain names to IPs so users can enter either format.
  8. Achieve sub-100ms query performance through optimised local database lookups.
  9. Include automated testing via Playwright for end-to-end quality assurance.

🧠 Core Features

1. IP Geolocation with Interactive Map

The primary feature:

  • Enter an IP address or domain name in the search field
  • Domain names are automatically resolved to their IP address via DNS
  • The IP is looked up against a local GeoIP database
  • Results include: city, region/state, country, postal code, latitude, longitude, timezone
  • An interactive world map (react-simple-maps) displays a marker at the resolved location
  • Map supports zoom, pan, and tooltip display
  • Multiple lookups can be compared on the same map view

2. Comprehensive DNS Resolution

Full DNS record retrieval:

  • PTR -- reverse DNS lookup revealing the hostname associated with an IP
  • A -- IPv4 address records for domains
  • AAAA -- IPv6 address records
  • MX -- mail exchange servers with priority values
  • TXT -- SPF, DKIM, DMARC, and other text records

Results are displayed in a structured table with record type, value, and TTL. This provides a complete DNS profile alongside the geolocation data.

3. WHOIS Integration

Domain and IP ownership information:

  • Registrant name, organisation, and contact details (where available)
  • Registration and expiry dates
  • Nameserver configuration
  • Registrar information
  • WHOIS server source
  • Raw WHOIS response available for detailed inspection

4. ASN and ISP Detection

Network operator identification:

  • Autonomous System Number (ASN)
  • ISP / organisation name
  • Network range (CIDR block)
  • Regional Internet Registry (RIR) allocation
  • Allocation date
  • Network type classification (hosting, ISP, enterprise, educational)

This data is sourced from a locally maintained ASN database table, ensuring fast lookups without external API calls.

5. Proxy, VPN, and Anonymiser Detection

Privacy and anonymisation detection:

  • Known VPN provider IP ranges
  • Public proxy server identification
  • Tor exit node detection
  • Web proxy and anonymiser flagging
  • Data centre / hosting provider identification (often used for automated traffic)

The detection uses a dedicated proxy block table in the MySQL database, updated periodically with known anonymiser ranges.

6. Threat Intelligence and Fraud Scoring

Risk assessment:

  • Composite threat score based on multiple signals
  • Fraud risk rating (low, medium, high, critical)
  • Contributing factors breakdown (proxy usage, hosting provider, known abuse ranges)
  • Historical abuse reports where available
  • Useful for security teams, fraud prevention, and access control decisions

7. Auto-Resolution of Domain Names

User-friendly input handling:

  • Users can enter either an IP address (e.g., 8.8.8.8) or a domain name (e.g., google.com)
  • Domain names are automatically resolved to their primary IP address
  • Both the domain and resolved IP are displayed in results
  • Supports subdomains and fully qualified domain names

🛠 Technical Architecture

Frontend

  • Framework: Next.js 14 with React 18
  • Language: TypeScript
  • Styling: Tailwind CSS
  • Map: react-simple-maps with custom projections and markers
  • Layout: Responsive design with card-based result panels

Backend

  • Runtime: Next.js API routes (server-side)
  • DNS Resolution: Node.js dns module for PTR, A, AAAA, MX, TXT lookups
  • WHOIS: Server-side WHOIS client
  • Database Queries: Direct MySQL queries for GeoIP, ASN, and proxy lookups

Database

  • Engine: MySQL 8
  • Tables:
    • geoip_city -- IP range to city/coordinates mapping
    • geoip_country -- IP range to country mapping
    • geoip_asn -- ASN/ISP ownership data
    • proxy_blocks -- known proxy, VPN, and anonymiser ranges
  • Performance: Indexed on IP range columns for sub-100ms lookups
  • Data Source: GeoIP databases imported and maintained locally

Testing

  • Framework: Playwright
  • Coverage: End-to-end tests for search functionality, map rendering, DNS results, and error handling
  • CI-ready: Test suite can run in headless mode for automated pipelines

Infrastructure

  • Hosted on KNWS web server infrastructure
  • MySQL on the dedicated database server
  • Next.js served via Node.js runtime

🔧 Pipeline & Workflow

  1. GeoIP databases are periodically downloaded and imported into MySQL tables.
  2. User enters an IP address or domain name in the search interface.
  3. Server resolves domain to IP if needed, then queries all data sources in parallel.
  4. Results aggregate geolocation, DNS, WHOIS, ASN, proxy detection, and threat scores.
  5. Frontend renders the map marker, data cards, and DNS record tables.
  6. Playwright tests validate the full flow after any code changes.

📈 Outcome & Impact

IP Geolocation demonstrates:

  • Next.js full-stack development -- server-side API routes with React frontend
  • Database optimisation -- sub-100ms queries across large GeoIP datasets
  • Network engineering knowledge -- DNS, WHOIS, ASN, BGP concepts implemented practically
  • Security tooling -- proxy/VPN detection and threat scoring for real-world security applications
  • Interactive data visualisation -- react-simple-maps for geographic display
  • TypeScript engineering -- type-safe codebase throughout
  • Automated testing -- Playwright end-to-end test coverage

The platform serves as both a practical network diagnostic tool and a demonstration of combining multiple data sources into a unified intelligence interface.