Geoloc that IP

# Context

You’re investigating an incident, a bug, what have you, and you’re dealing with lots of IP addresses. You’d like a way to find out where is that IP address from so you can get a rough idea of who’s who.

A whole host of websites allow you to geolocate IP addresses (iplocation.net for instance). But that’s not fast enough, and probably won’t scale if you need to batch process IPs.

# Bash function FTW

This bash function goes in your .bashrc file, and fetches all the geolocation you need for a given IP address.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
function freegeoip () {
  # Get result from freegeoip API
  local FGIP_RES=$(curl --request GET --url https://freegeoip.live/json/$1 header 'accept: application/json' --header 'content-type: application/json' -s)

  local LAT=$(echo $FGIP_RES | jq .latitude)
  local LON=$(echo $FGIP_RES | jq .longitude)

  echo $FGIP_RES | jq

  # Get approximate location from GPS coordinates
  curl --request GET --url "https://nominatim.openstreetmap.org/reverse?format=jsonv2&lat=$LAT&lon=$LON" --header 'accept: application/json' --header 'content-type: application/json' -s | jq .address
}

Function requires curl & jq.

# Usage

To find your own IP address & location, simply run freegeoip.

To locate another address, pass it as an argument. For example freegeoip 1.1.1.1 returns 👇.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
{
  "ip": "1.1.1.1",
  "country_code": "AU",
  "country_name": "Australia",
  "region_code": "",
  "region_name": "",
  "city": "",
  "zip_code": "",
  "time_zone": "Australia/Sydney",
  "latitude": -33.494,
  "longitude": 143.2104,
  "metro_code": 0
}
{
  "road": "Gol Gol Road",
  "municipality": "Wentworth Shire Council",
  "county": "Balranald Shire Council",
  "state": "New South Wales",
  "country": "Australia",
  "country_code": "au"
}