There is no denying that we need all the help we can get as cyberattacks evolve. IP geolocation data is among the most useful threat intelligence sources that can strengthen an organization’s cybersecurity posture. Primarily, tools such as IP Geolocation Database or its API counterpart can help us map the location of a device or user. However, more than that, they can help prevent prevalent cybercrime.

In this post, let us dive into three uses of IP geolocation in the field of cybersecurity.

Prevent Phishing Emails from Reaching Staff Inboxes

Phishing is still a rampant cyberattack type, and everyone is susceptible to it. It can also come in several forms—aside from the original phishing email attack, we also need to be wary of vishing and smishing.

Consider a newly hired employee who received what seemed to be a welcome email from Salesforce Onboarding. Clicking a link that says, “Learn about your benefits,” redirected him to an unknown website. What happened? The new employee just unknowingly installed a keylogger when he clicked the link. The victim does not have to be a new employee, in any case. Even tenured staff can be lured into “learning about their benefits.”

However, companies can minimize the phishing risks if they integrate IP Geolocation API or use its database version alongside their email security solutions. When the employee in our hypothetical scenario receives an email from Salesforce, for instance, the company can set its email security tool to automatically run the IP address on IP Geolocation API to check if it truly belongs to Salesforce.

For example, if the email is from the IP address 150[.]129[.]8[.]34, IP Geolocation API would alert the recipient and the security team that it is not associated with Salesforce. Further investigation would also reveal that the IP address has been reported 174 times for abusive activity.

Compared to the result, when a Salesforce IP address is run on the tool, you would see glaring differences.

Furthermore, the organization can check against the IP Geolocation Database to see which IP addresses are used by Salesforce and add these to their whitelist.

Minimize Card-Not-Present Fraud

Phishing attacks can also lead to stolen credit card and bank information, which would end up for sale on the Dark Web. The availability of these financial details makes it easier for threat actors to commit card-not-present (CNP) fraud. However, if merchants and card companies employ IP geolocation tools, they can prevent such fraudulent transactions from taking place.

For example, the IP geolocation tool would tell a credit card company that a transaction coming from IP address 45[.]143[.]221[.]54 originated in Nuremberg, Germany. The credit card owner, however, has never made any purchase outside the U.S. The credit card company’s anti-fraud solutions would then alert the merchant of the suspicious transaction, and it would be declined. On the other hand, the credit card owner would also receive an alert to confirm if he or she made the transaction.

As such, merchants and credit card companies that use IP geolocation data in their fraud protection solutions can prevent CNP fraud.

Implement IP-Level Blacklisting

Organizations can stop suspicious IP addresses from repeatedly attacking by adding them to their blacklists. Companies would be better off blocking the IP address 45[.]143[.]221[.]54, for instance, as it has been reported 1,266 times for a wide range of malicious activities.

There are instances, though, where IP-level blacklisting can lead to blocking innocent and even useful domains. Several domains use shared IP addresses and may just happen to share one with a malicious domain. So, before blocking an IP address, it is best to check against the IP Geolocation Database to ensure that you are not blocking valuable domains.

Conclusion

Threat actors do not care where they commit crimes as long as they can gain something from it. Through phishing campaigns, they can gain valuable data that they can sell on the Dark Web or use to commit fraud. Nevertheless, these crimes are preventable with the appropriate security measures and tools.

IP Geolocation Database and API are two programs that can provide IP intelligence, which can help enrich security systems, whether they are email security solutions, fraud protection programs, or other cybersecurity tools.