- Attackers list: small country-code chip next to the IP on each card, title-tooltip shows the source (e.g. "rir") - AttackerDetail: country-code tag next to the IP in the header plus an ORIGIN field in the TIMELINE section for always-visible origin - TypeScript interfaces updated with country_code/country_source