<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-geolocation-intelligence
description: >-
  Extract and analyze geolocation data from images, IP addresses, social
  media posts, and network infrastructure to determine physical locations
  of targets and assets.
domain: cybersecurity
subdomain: osint-recon
tags:
  - geolocation
  - exif-analysis
  - ip-geolocation
  - geoint
  - location-intelligence
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: >-
  ExifTool, GeoIP2, ipinfo.io, MaxMind, creepy, Geopy,
  Google Maps API, Shodan, BSSID location APIs.
metadata:
  mitre-attack:
    - "T1591.001"  # Gather Victim Org Information: Determine Physical Locations
    - "T1590.005"  # Gather Victim Network Information: IP Addresses
    - "T1592"      # Gather Victim Host Information
---

# Analyzing Geolocation Intelligence

## Overview

Geolocation intelligence (GEOINT) determines physical locations of targets,
infrastructure, and personnel through technical analysis of IP addresses, image
metadata (EXIF), social media geotags, Wi-Fi BSSID mapping, and network
infrastructure placement. This supports physical security assessments,
infrastructure mapping, and threat actor attribution by correlating digital
artifacts with real-world locations.

## Prerequisites

- ExifTool for image metadata extraction
- MaxMind GeoLite2 or ipinfo.io for IP geolocation
- Python 3.10+ with `Pillow`, `geopy`, `geoip2`
- Shodan for infrastructure geolocation
- WiGLE API for Wi-Fi BSSID lookups

```bash
sudo apt install libimage-exiftool-perl -y
pip install Pillow geopy geoip2 requests folium
```

## Quick Reference

| Task | Command |
|------|---------|
| EXIF extract | `exiftool -gps* -json image.jpg` |
| EXIF GPS | `exiftool -c "%.6f" -GPSPosition image.jpg` |
| IP geolocation | `curl -s "https://ipinfo.io/1.2.3.4?token=$IPINFO_TOKEN"` |
| Bulk IP geo | `mmdbinspect -db GeoLite2-City.mmdb 1.2.3.4` |
| WiGLE BSSID | `curl -s -u "$WIGLE_USER:$WIGLE_KEY" "https://api.wigle.net/api/v2/network/search?netid=AA:BB:CC:DD:EE:FF"` |
| Strip EXIF | `exiftool -all= image.jpg` |
| Shodan geo | `shodan host 1.2.3.4 --fields location` |
| Batch EXIF | `exiftool -r -gps* -json ./images/ > all_gps.json` |

## Workflow

### Step 1: Image Metadata Analysis

```bash
# Extract all EXIF metadata from images
exiftool -json -g image.jpg | jq '.[] | .EXIF'

# Extract GPS coordinates specifically
exiftool -c "%.6f" -GPSLatitude -GPSLongitude -GPSAltitude image.jpg

# Batch extract GPS from directory
exiftool -r -c "%.6f" -GPSPosition -FileName -json ./images/ \
  | jq '.[] | select(.GPSPosition != null) | {file: .FileName, gps: .GPSPosition}'

# Extract camera and device information
exiftool -Make -Model -Software -DateTime -SerialNumber image.jpg
```

### Step 2: IP Address Geolocation

```bash
# ipinfo.io — single IP
curl -s "https://ipinfo.io/1.2.3.4?token=$IPINFO_TOKEN" \
  | jq '{ip, city, region, country, loc, org}'

# MaxMind GeoLite2 — bulk lookup
python3 -c "
import geoip2.database
reader = geoip2.database.Reader('GeoLite2-City.mmdb')
r = reader.city('1.2.3.4')
print(f'{r.city.name}, {r.subdivisions.most_specific.name}, {r.country.name}')
print(f'Lat: {r.location.latitude}, Lon: {r.location.longitude}')
"

# Shodan — IP geolocation with service context
shodan host 1.2.3.4 --fields ip_str,location.city,location.country_name,ports,hostnames
```

### Step 3: Wi-Fi and Network Geolocation

```bash
# WiGLE — BSSID to physical location
curl -s -u "$WIGLE_USER:$WIGLE_KEY" \
  "https://api.wigle.net/api/v2/network/search?netid=AA:BB:CC:DD:EE:FF" \
  | jq '.results[] | {ssid, trilat, trilong, lastupdt}'

# Bulk BSSID lookup
cat bssids.txt | while read bssid; do
  curl -s -u "$WIGLE_USER:$WIGLE_KEY" \
    "https://api.wigle.net/api/v2/network/search?netid=$bssid" \
    | jq -r ".results[0] | \"$bssid,\(.trilat),\(.trilong),\(.ssid)\""
done > bssid_locations.csv
```

### Step 4: Social Media Geolocation

```bash
# Extract geotags from social media content
# Twitter/X API — geotagged posts
curl -s -H "Authorization: Bearer $TWITTER_TOKEN" \
  "https://api.twitter.com/2/tweets/search/recent?query=from:username has:geo&tweet.fields=geo"

# Instagram location correlation (via public API data)
# Analyze location tags, check-ins, and background landmarks
```

### Step 5: Correlation and Visualization

```bash
# Generate map visualization
node agent.js --domain target.com --full --output geo_report.json

# Create Folium map from collected coordinates
python3 -c "
import folium, json
m = folium.Map(location=[40.7128, -74.0060], zoom_start=10)
with open('geo_report.json') as f:
    data = json.load(f)
for loc in data.get('locations', []):
    folium.Marker([loc['lat'], loc['lon']], popup=loc['label']).add_to(m)
m.save('geo_map.html')
"
```

## Detection Opportunities

- EXIF analysis is fully offline and undetectable
- IP geolocation API queries are logged per API key
- WiGLE queries may expose investigation targets
- Social media API access is authenticated and rate-limited

## Verification

- [ ] Image EXIF metadata extracted and GPS coordinates mapped
- [ ] IP addresses geolocated with confidence levels noted
- [ ] Wi-Fi BSSID locations correlated where available
- [ ] Social media geotags analyzed and cross-referenced
- [ ] Physical locations visualized on interactive map
- [ ] Geolocation accuracy limitations documented

## References

- [ExifTool](https://exiftool.org/)
- [ipinfo.io](https://ipinfo.io/)
- [MaxMind GeoLite2](https://dev.maxmind.com/geoip/geolite2-free-geolocation-data)
- [WiGLE](https://wigle.net/)
- [Folium](https://python-visualization.github.io/folium/)
- [Shodan](https://www.shodan.io/)

---
v1.0 | Validated: 2026-03-17
