ISSUE:
When an IP was detected in BOTH a hostile country AND hostile ASN:
- Hostile country = +10 geo_bonus
- Hostile ASN = +15 geo_bonus
- Combined = +25 geo_bonus total
Using elif logic meant only ONE tag was shown:
- [ "$geo_bonus" -ge 15 ] && tag "HOSTILE-ASN" (TRUE, added tag)
- elif [ "$geo_bonus" -lt 15 ] && tag "HOSTILE-GEO" (FALSE, skipped)
Result: IPs with BOTH conditions only showed "HOSTILE-ASN" tag, hiding
the country-based threat intelligence.
ROOT CAUSE:
Lines 2991-2992 used elif conditional structure that prevented both
tags from being set when geo_bonus >= 25.
FIX:
Replaced elif logic with independent flag-based checks:
1. Check if geo_bonus >= 15 (hostile ASN indicator)
2. Check if 10 <= geo_bonus < 15 (hostile country only)
3. Special case: if geo_bonus >= 25, set BOTH flags (indicating dual threat)
This allows proper tagging of coordinated attacks from both hostile
countries AND hostile ASNs.
IMPACT:
- IPs from coordinated botnets in hostile jurisdictions now properly
show both "HOSTILE-ASN" and "HOSTILE-GEO" tags
- Improved threat visibility for geographic clustering analysis
- No performance impact (simple flag checks)
LINES CHANGED: 2991-2992 (expanded to ~2991-3008 for clarity)
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
cschantz
c4bdf9e73f