A cryptomining alert lands with a source IP tagged “Ashburn, Virginia,” confidence 92%. Your playbook says escalate foreign infrastructure. The address belongs to a US cloud region that also hosts dozens of legitimate AI inference tenants. Meanwhile, RMM probes from the same week resolve to a city three time zones away from the ASN’s actual peering location. The pain is familiar: geolocation looks decisive in the ticket, then melts under a WHOIS, looking-glass, and routing check.
October’s threat traffic makes that gap expensive. PoeLLM-style campaigns against exposed AI servers ride shared hosting and cloud ranges. RMM tools in the wild reuse residential and commercial exit pools. Autonomous defense platforms and machine-speed block decisions treat a city label as a hard attribute. If your geo pipeline cannot state precision and freshness, country and city controls will quarantine the wrong neighbors or miss the real exit.
What “accurate” actually means for IP geo
IP geolocation products answer different questions at different resolutions. Country and continent mappings stay relatively stable for many fixed allocations. City and postal claims drift when providers reassign space, announce anycast, or hand customers carrier-grade NAT. Coordinates often describe a POP, a registry mailing address, or a statistical centroid, not the keyboard that generated the packet.
For security operations, treat each record as a tuple, not a pin on a map:
- Precision floor: country, region, city, or coordinates, plus an explicit confidence or radius when the vendor supplies one.
- Allocation vs. observation: RIR registration country versus where the prefix is routed and peered today.
- Egress class: cloud region, CDN anycast, mobile CGNAT, residential proxy, enterprise VPN, or dedicated hosting.
- Freshness: database build date and whether your resolver refreshes daily, weekly, or only at image build time.
A city hit at 40% confidence is a hint for enrichment. A country hit at high confidence on a stable enterprise prefix is usable for coarse policy. Mixing those two into one “geo = X” field is how false attribution enters the shift.
Where geo breaks during live campaigns
Shared cloud and AI hosting
When malware such as PoeLLM lands on exposed AI servers, the beacon IP often geolocates to a well-known data-center city. That city also contains clean customers. Blocking “the city” or even “the /24’s registered country” without ASN, hosting role, and process context will catch tenants who share the rack neighborhood. Prefer region-plus-ASN scoping and host forensics over city-wide caps for these ranges.
RMM and remote-support egress
With more RMM tooling observed in the wild, admin consoles and agent callbacks frequently exit through MSPs, cloud jump hosts, or consumer ISPs. Geo may show the MSP’s headquarters city while the technician sits elsewhere. Country filters on RMM ingress need a allowlist of known MSP and vendor ASNs, and city labels should stay out of automated quarantine decisions.
Anycast, CGNAT, and mobile paths
Anycast can make the same address answer from multiple metros; databases often pick one popular city. CGNAT folds thousands of subscribers behind one public IP whose geo tracks the carrier POP. Mobile users hop cities while the public address stays put. For those classes, demote city and coordinate fields to informational only.
Machine-speed enforcement
Products pitched for autonomous, machine-speed defense will act on enrichment as fast as it arrives. If geo confidence and egress class are missing from the decision object, you inherit every stale city mapping at wire speed. Gate automated geo actions on precision thresholds and egress class, the same way you gate severity-driven blocks.
Do this today
Open three recent tickets that used a geo field in the decision (country block, “foreign VPN,” or city-based escalation). For each source IP, record:
- Vendor country, region, city, and confidence or radius.
- Origin ASN and whether it is cloud, CDN, transit, residential, or mobile.
- Whether the address is anycast or appears in multiple looking-glass vantage points.
- What action you took, and whether a second enrichment source disagreed at city level.
Tag the ticket with a simple precision grade: country-only, region-ok, or city-untrusted. Require analysts to pick a grade before a geo-driven change leaves the change window. That single habit stops city pins from driving production drops on CGNAT and cloud edges.
Also verify which geo database your edge, SIEM, and TIP actually load. Mismatched MaxMind/IP2Location/vendor builds across WAF, firewall, and SIEM produce “same IP, different country” fights during the same incident. Align versions or document which system is authoritative for policy versus which is for hunt notes.
This week: wire precision into detections and policy
Update enrichment so every IP object carries structured geo metadata, not a free-text city string. Minimum fields:
geo.country,geo.region,geo.citygeo.precision(enumerated)geo.confidenceorgeo.accuracy_radius_kmgeo.sourceandgeo.as_ofegress.classderived from ASN and hosting intel
Then bind controls to those fields:
- Country filters on VPN, RMM, and admin ingress: allow only when
geo.precisionis at least country andegress.classis not cloud-anycast unless the ASN is on an exception list. - City-based alerts: informational severity unless confidence clears your threshold and egress class is dedicated hosting or enterprise.
- Cryptomining and AI-server abuse hunts: join geo to process, container, and GPU/CPU saturation signals. Use city only to prioritize which cloud account owner to page, after ASN and tenant mapping already narrowed the scope.
Run a short tabletop with one PoeLLM-like beacon IP and one RMM probe IP. Walk the room through the graded fields above. If anyone jumps from city string to country block without checking ASN class, rewrite that step in the runbook the same day.
This quarter: treat geo as a calibrated sensor
Build a quarterly accuracy review the way you calibrate IDS. Sample 200 production decisions that cited geo. Score each against routing reality (looking glass, IRR/RPKI where useful, provider documentation) and mark country correct / city correct / class correct. Track error rates by vendor and by egress class. Feed the worst classes back into policy: for example, never auto-block on city for mobile and CDN ASNs.
Maintain dual sources for high-impact paths. When source A and source B disagree on country, freeze automated geo actions and open a human review with ASN and passive DNS. When they agree on country but disagree on city, keep country policy and drop city from the decision record.
Fold geo freshness into patch-week and advisory response. Exploit waves and RMM abuse spikes drive rapid prefix reassignment and new bulletproof ranges. Schedule database updates before those windows when you can, and raise the confidence bar for city-driven automation while advisory noise is high. Pair that with the broader October context: large patch drops (including Microsoft’s high-volume fixes) and machine-speed defense rollouts both increase how often geo is consulted under time pressure. Calibration prevents speed from outrunning correctness.
Concrete scenario walkthrough
Scenario. SIEM fires “outbound to mining pool” from a GPU host. Enrichment shows IP in Frankfurt, confidence medium. ASN is a major cloud provider; looking glass shows the prefix announced from a US region. Passive DNS ties the address to a short-lived A record used by several tenants last month.
Correct path. Grade precision as country-untrusted for policy and city-untrusted for attribution. Contain by host and security group, not by geo. Page the cloud account owner using instance identity. Preserve the Frankfurt label only as vendor noise in the case notes. If you later need perimeter policy, scope to the specific /32 or the provider’s documented mining-related ranges after confirmation, never to “Germany” or “Frankfurt.”
RMM variant. Auth logs show ScreenConnect-style access from an IP geolocated to a small US city. ASN is a residential ISP. Treat city as irrelevant; score the session against known technician inventory, MFA, and peer clustering. Geo contributes “residential egress,” which raises scrutiny, without inventing a travel story for the analyst.
Operator takeaways
- Store precision, confidence, freshness, and egress class beside every geo label you show an analyst or feed into automation.
- Use country for coarse ingress policy on stable enterprise paths; keep city for enrichment and prioritization after ASN class is known.
- For AI-server abuse and cryptomining on shared cloud, join geo to tenant and host signals before any geographic control.
- For RMM and remote support, prefer MSP/vendor ASN allowlists over city or postal filters.
- Align geo database versions across edge, SIEM, and TIP, then recalibrate error rates each quarter by egress class.
- Require a precision grade in the ticket before a geo-driven production change ships.
Geolocation remains useful when you treat it as a graded sensor with known failure modes. Shared AI hosting, RMM exits, and machine-speed blockers all punish teams that still paste a city name into the decision field. Score precision first, then decide how wide the control is allowed to be.
