Geo & Network Context

Every host on the internet has a geographic location (country, city, latitude, longitude) and a network operator (ISP, hosting provider, organisation). QROS geolocates every indexed host and tags it with its network context — so you can scope your exposure assessment by geography, organisation, or network range.

How QROS geolocates hosts

QROS uses the db-ip.com IP geolocation database (CC BY 4.0) to map every IP address to its country, city, and approximate latitude/longitude. The ASN database (MaxMind GeoLite2 ASN, also free) maps every IP to its network operator — the ISP, hosting provider, or organisation that owns the IP range.

Scope exposure by country

Search all hosts in Spain, all hosts in the United States, or all hosts in Germany to see the exposure surface of a specific jurisdiction. This is critical for compliance with country-specific regulations like NIS2 (EU), DORA (EU financial entities), or national cybersecurity frameworks.

Scope exposure by organisation

Search by organisation to find all hosts owned by a specific ISP, hosting provider, or company. This helps security teams scope their exposure assessment to their own infrastructure, and helps researchers identify concentrations of vulnerable hosts in specific networks.

Map view

QROS shows each host on an interactive OpenStreetMap map (© OpenStreetMap contributors), with markers colored by risk level. Zoom into a city, click a marker, and see the full host dossier — ports, services, CVEs, TLS certificate, web technologies.

What geo context looks like in QROS

Each host in QROS shows its country flag, city, and network operator. Here's how the latest scans appear in the Explore feed: