Would a question about attackers IP address be on topic?
I think it relates to risk management, but the link is weak. Specifically I am interested in asking:
How do I most accuratly resolve an attacker's IP address to a country, and with what certainty do I know the country assignment to be correct.