geoiplookup.py

# download GeoIPCity.dat from http://dev.maxmind.com/geoip/geolite
# pip install pygeoip
# get ip list eg. from sshguard logs:
# zgrep Blocking /var/log/auth.log* | cut -d ' ' -f 7 | cut -d ':' -f 1 | sort -u > ips.txt
# python geoiplookup.py ips.txt (or directly cat)

import fileinput
import sys

import pygeoip
gi = pygeoip.GeoIP('./GeoIPCity.dat')

def lookup(ip):
    record = gi.record_by_addr(ip)
    if 'city' in record:
        return record['country_name'], record['city']

    return (record['country_name'], )

if __name__ == '__main__':
    for line in fileinput.input():
        print lookup(line)

example output

('Brazil', '')
('Brazil', u'Boa Vista')
('Canada', u'Toronto')
('China', '')
('China', u'Beijing')
('China', u'Changzhi')
('China', u'Fushun')
('China', u'Guangzhou')
('China', u'Hangzhou')
('China', u'Hebei')
('China', u'Hefei')
('China', u'Jiaxing')
('China', u'Kunming')
('China', u'Nanchang')
('China', u'Shanghai')
('China', u'Wuhan')
('China', u'Wuxi')
('China', u'Xian')
('China', u'Zhongshan')
('China', u'\xdcr\xfcmqi')
('France', '')
('France', u'Paris')
('Germany', '')
('Germany', u'Hennef')
('Germany', u'N\xfcrnberg')
('Hong Kong', u'Kowloon')
('India', u'Mumbai')
('India', u'Thrissur')
('Italy', '')
('Jamaica', u'Kingston')
('Korea, Republic of', '')
('Korea, Republic of', u'Seoul')
('Macedonia', u'Skopje')
('Mexico', u'Iztapalapa')
('Mexico', u'Tijuana')
('Philippines', u'Makati')
('Poland', u'Warsaw')
('Russian Federation', '')
('Russian Federation', u'Moscow')
('Switzerland', u'Geneve')
('Taiwan', u'Taipei')
('Thailand', '')
('Turkey', '')
('Turkey', u'Istanbul')
('Turkey', u'Mars')
('United Kingdom', '')
('United States', u'Atlanta')
('United States', u'Buffalo')
('United States', u'Dallas')
('United States', u'Manassas')
('United States', u'Overland Park')
('United States', u'Port Chester')
('United States', u'Portland')
('United States', u'San Antonio')
('United States', u'San Jose')