diff --git a/core-private-routes.md b/core-private-routes.md
index 2a77b24..4b1a43a 100644
--- a/core-private-routes.md
+++ b/core-private-routes.md
@@ -152,4 +152,4 @@ Authentication: pass `x-node-auth-key` as gRPC metadata (or in the `authKey` fie
 
 The node sends `ReportNodeStats` every 2 s. `GET /admin/nodes/:id/runtime-status` returns the latest stored snapshot without polling the node; `?fromNode=true` forces a live HTTP fetch instead.
 
-The node sends `ReportOnlineUsers` every 5 s. Core sets `online:user:{userId}` and `online:inbound:{nodeProtocolId}:user:{userId}` Redis keys with TTL 20 s. Existing `(userId, ip)` rows only receive a new `lastSeenAt`; missing pairs are inserted. IP information enrichment supports IPinfo.io and ip-api.com. A daily job refreshes all known addresses, while a job running every 10 minutes processes addresses with `firstSeenAt > now - 10 minutes`. Results are stored in `user_ips.info`. Core also emits a `user.online` domain event when the user had a gap > 10 s.
+The node sends `ReportOnlineUsers` every 5 s. Core sets `online:user:{userId}` and `online:inbound:{nodeProtocolId}:user:{userId}` Redis keys with TTL 20 s. Existing `(userId, ip)` rows only receive a new `lastSeenAt`; missing pairs are inserted. Private RFC1918 IPv4 addresses, IPv4-mapped private addresses, and IPv6 ULA addresses can still establish online presence but are excluded from `user_ips` writes. IP information enrichment supports IPinfo.io, ip-api.com, and FindIP.net. FindIP requests are sent sequentially per IP, and failed lookups are skipped. A daily job refreshes all known addresses, while a job running every 10 minutes processes addresses with `firstSeenAt > now - 10 minutes`. Results are stored in `user_ips.info`. Core also emits a `user.online` domain event when the user had a gap > 10 s.
diff --git a/core-routes.md b/core-routes.md
index 737e5d8..b212785 100644
--- a/core-routes.md
+++ b/core-routes.md
@@ -210,7 +210,7 @@ This file lists the current HTTP routes exposed by Core, grouped by access level
 | `PATCH` | `/admin/settings/panel` | `PanelSettingsDto` | Updates panel settings |
 | `PATCH` | `/admin/settings/subscription` | `SubscriptionSettingsDto` | Updates subscription delivery settings |
 | `PATCH` | `/admin/settings/telegram` | `TelegramSettingsDto` | Updates Telegram bot settings |
-| `PATCH` | `/admin/settings/ipinfo` | `{ provider?: "ipinfo" \| "ip-api", token?: string, language?: "ru" \| "en" }` | Updates the IP information provider settings. `token` is required by IPinfo.io; `language` is used by ip-api.com and defaults to `en`. The route name is retained for compatibility. |
+| `PATCH` | `/admin/settings/ipinfo` | `{ provider?: "ipinfo" \| "ip-api" \| "findip", token?: string, language?: "ru" \| "en" }` | Updates the IP information provider settings. `token` is required by IPinfo.io and FindIP; `language` is used by ip-api.com and FindIP and defaults to `en`. The route name is retained for compatibility. |
 | `PATCH` | `/admin/settings/donation-alerts` | `{ clientId?: string, clientSecret?: string, redirectUri?: string, donationPageUrl?: string, commissionPercent?: number }` | Saves DonationAlerts OAuth application and payment settings. Changing OAuth credentials clears existing tokens. |
 | `POST` | `/admin/payments/donation-alerts/authorization-url` | none | Creates a short-lived OAuth state and returns the DonationAlerts authorization URL with `oauth-donation-index` scope. |
 | `POST` | `/admin/payments/donation-alerts/callback` | `{ code: string, state: string }` | Exchanges an OAuth callback code for access and refresh tokens. Access tokens are refreshed automatically. |
diff --git a/core.md b/core.md
index 5d2d1b0..399b40a 100644
--- a/core.md
+++ b/core.md
@@ -17,7 +17,7 @@ This page is public operator documentation. It describes behavior, API, environm
 - External subscription source ingestion and testing.
 - Public subscription exports for VPN clients.
 - Platform settings management (panel, subscription delivery, Telegram, IP information provider).
-- User IP history with country, city, ISP, and ASN enrichment through IPinfo.io or ip-api.com.
+- User IP history with country, city, organization, and ASN enrichment through IPinfo.io, ip-api.com, or FindIP.net.
 - OAuth-based DonationAlerts integration with automatic token refresh and RUB balance deposits linked by user UUID.
 - DonatePay API integration with automatic RUB balance deposits linked by UUID in the donation comment.
 - Telegram broadcast messages with user filtering and delivery tracking.
diff --git a/panel.md b/panel.md
index 2501f61..a37f459 100644
--- a/panel.md
+++ b/panel.md
@@ -70,7 +70,7 @@ This page is public operator documentation. It describes panel capabilities, rou
 - Configure panel access settings (allowed hosts, root path).
 - Configure subscription delivery settings (update interval, display name, support URL).
 - Configure Telegram bot token.
-- Configure the user IP information provider: IPinfo.io with an API token, or ip-api.com with Russian or English result language. English is the default for ip-api.com.
+- Configure the user IP information provider: IPinfo.io with an API token, ip-api.com with Russian or English result language, or FindIP.net with an API key and Russian or English localization. English is the default.
 - Configure a DonationAlerts OAuth application with its client ID, client secret, generated callback URL, public donation page URL, and commission percentage. After saving, authorize it through DonationAlerts; access and refresh tokens are stored and refreshed automatically.
 - Configure DonatePay with an API token, public donation page URL, and an optional commission percentage.