ONYPHE has made available a free API and free MMDB download of their new Geolocus database. It provided IP address metadata in the form of:
{
"abuse":
[
"amzn-noc-contact@amazon.com",
"aws-routing-poc@amazon.com",
"aws-rpki-routing-poc@amazon.com",
"trustandsafety@support.aws.com"
],
"asn": "AS14618",
"continent": "NA",
"continentname": "North America",
"country": "US",
"countryname": "United States",
"domain":
[
"amazon.com",
"amazonaws.com",
"aws.com"
],
"ip": "3.215.138.152",
"isineu": 0,
"latitude": "37.09024",
"location": "37.09024,-95.712891",
"longitude": "-95.712891",
"netname": "AMAZON-IAD",
"organization": "Amazon Data Services NoVa",
"physical_asn": "AS14618",
"physical_continent": "NA",
"physical_continentname": "North America",
"physical_country": "US",
"physical_countryname": "United States",
"physical_isineu": 0,
"physical_latitude": "37.09024",
"physical_location": "37.09024,-95.712891",
"physical_longitude": "-95.712891",
"physical_organization": "Amazon.com, Inc.",
"physical_subnet": "3.208.0.0/12",
"physical_timezone": "America/Chicago",
"subnet": "3.208.0.0/12",
"timezone": "America/Chicago"
}
Since it’s way more efficient to use the MMDB file than the API, I built a cross-platform CLI tool for it: https://codeberg.org/hrbrmstr/geolocus-cli.
also with binary releases: https://codeberg.org/hrbrmstr/geolocus-cli/releases
Code is also available via Tangled Knot: https://tangled.sh/@hrbrmstr.dev/geolocus-cli
Usage:
# Download the latest Geolocus database
geolocus-cli download
# Look up IPs from a file
geolocus-cli lookup -i ips.txt -o results.json
# Process IPs from stdin and output to stdout
cat ips.txt | geolocus-cli lookup
# Output in CSV format
geolocus-cli lookup -i ips.txt -f csv -o results.csv
# Output in JSONL format (one JSON object per line)
geolocus-cli lookup -i ips.txt -f jsonl -o results.jsonl
# Disable session caching
geolocus-cli lookup -i ips.txt --no-cache
CLI options:
Commands:
download Download a fresh copy of the geolocus.mmdb database
lookup Lookup and enrich IP addresses from a file or stdin
Options:
-h, --help Show help information
-i, --input <file> Input file containing IP addresses (one per line)
-o, --output <file> Output file for results (defaults to stdout)
-f, --format <format> Output format: json, csv, or jsonl (default: json)
--no-cache Disable IP caching for the current session

Trump’s Retaliation Against Chris Krebs — and the Cybersecurity Industry’s Deafening Silence
Chris Krebs, the former director of the Cybersecurity and Infrastructure Security Agency (CISA), was fired by Donald Trump in 2020 for publicly affirming that the presidential election was secure and free from widespread fraud. Fast-forward to April 2025: Trump, now back in the White House, issued an executive order revoking Krebs’ security clearances and ordering a federal investigation into his conduct, specifically targeting both Krebs and his employer, SentinelOne. The order also suspended clearances for other SentinelOne employees and threatened the company’s ability to do business with the government.
Krebs responded by resigning from SentinelOne to fight the administration’s campaign against him, stating, “This is a fight for democracy, freedom of expression, and the rule of law. I’m ready to give it my all”. SentinelOne’s stock dropped, and the chilling effect on the broader cybersecurity sector was immediate and palpable.
The Industry’s Response: Silence, Not Solidarity
Despite Krebs’ reputation for professionalism and integrity, the cybersecurity industry has, with rare exceptions, responded with silence. Reuters reached out to 33 major cybersecurity firms and three industry groups—only one responded with a comment. Industry leaders, major vendors, and conference organizers have largely avoided public statements. Even companies with direct ties to Krebs, such as Microsoft and CrowdStrike, declined to comment.
This silence is not just disappointing—it’s dangerous. The executive order against Krebs is not merely a personal vendetta; it is a test of constitutional norms and the independence of the cybersecurity profession. By targeting Krebs for telling the truth, the administration is sending a message: dissent—especially when it contradicts the preferred political narrative—will be punished. The industry’s lack of response is, in effect, complicity.
Why This Matters
What Every RSA Attendee Should Do
RSA Conference 2025’s theme is “Many Voices. One Community.” But a community that stays silent in the face of injustice is not united—it is complicit. Every attendee, whether you’re a practitioner, vendor, or “A-lister,” has a responsibility to meet this moment.
When you visit vendor booths or encounter cybersecurity leaders and influencers at RSA, ask them:
Don’t let them dodge. Don’t accept platitudes.
If you’re a vendor or a leader: issue a public statement. Sign an open letter. Organize a session or a panel on defending professional independence. Use your platform—on stage, on social media, in the press—to call out this abuse of power.
If you’re an attendee: demand answers. Refuse to let silence be the industry’s answer to authoritarian overreach.
Remember: Silence is not safety. Silence is capitulation. If the cybersecurity community cannot defend its own when the truth is under attack, then what exactly are we protecting?
This is your moment. Don’t waste it.