The Elastic GeoIP service (geoip.elastic.co) is the default endpoint from which Elasticsearch's GeoIP processor downloads the database used for looking up ASN/city/country data for an IP address. On 2026-04-22 at 16:00 UTC, this service will start returning download URLs on the following domains:
d24a988e385e0074d717b6bdaea58f0d.r2.cloudflarestorage.com*.d24a988e385e0074d717b6bdaea58f0d.r2.cloudflarestorage.com
Previously, the download URLs were on the storage.googleapis.com domain, which will no longer be used.
If one of the domains above is not allow-listed, you will see errors similar to the following in your Elasticsearch log and your documents will be tagged with _geoip_database_unavailable*:
… error downloading geoip database …
If you have firewalls, proxies, or other security appliances that filter traffic by domain name, please be sure to update the allow list for the new domains. Note that the domains are the same as what is used for the Elastic Docker Registry (docker.elastic.co). If you already allowed these domains for the registry storage migration from December 2025, then no further action is needed.