How IP geolocation works, and why it is often wrong

Nothing in the address says where it is

An IP address is a number used for routing packets. Cloudflare's documentation says it plainly: there is nothing that inherently binds an IP address to a physical location or country. Addresses are handed out in blocks, blocks change hands, and networks move traffic between cities. Any location attached to an address is a record kept somewhere else.

There are three main places such records come from: the registries that hand out address blocks, the network operators who use them, and the companies that sell geolocation databases.

Source one: the registry chain

IANA coordinates the global pool of IP addresses. It allocates large blocks to the Regional Internet Registries (RIRs), and, as IANA describes it, ISPs obtain allocations from a local or national registry or from their RIR, then assign addresses to their users.

Each registry publishes who holds each block: the organisation name, the address range, an abuse contact, and the country where the holder is registered. That country is a fact about the paperwork, not about where a given device sits. A company registered in one country can use its addresses in data centres on several continents.

Source two: feeds published by the network

The network operator knows best where its addresses are used, so RFC 8805 defines a simple text format, a geolocation feed or geofeed, that an operator can publish for others to download. Each line is a prefix followed by a country code (ISO 3166-1 alpha-2), an optional region code and an optional city. The format deliberately allows only coarse locations, and its postal code field is deprecated.

RFC 8805 notes that at least one large consumer, Google, uses these feeds in its geolocation pipeline, and that many ISPs publish them to influence where their prefixes are placed.

Source three: commercial databases

Database vendors merge registry data, geofeeds and their own measurements into one table that maps address ranges to places. Services that need a location, from a website showing local prices to Cloudflare adding a country header, look the visitor's address up in such a table. Cloudflare says it updates its own database several times a week.

Vendors are open about the limits. MaxMind, a geolocation database vendor, states that its data is never precise enough to identify a household, individual or street address. For its own data it estimates 99.8% accuracy at country level, and for addresses in the United States about 80% at state level and 66% for cities within 50 km. It also returns an accuracy radius, such as 100 km, instead of pretending to know a point.

Why your own result can be far off

Several ordinary situations move the answer away from where you are:

• Mobile networks: MaxMind notes that one mobile address can be used by phones across a large area, so only the country or region may be known.
• Carrier-grade NAT: RFC 7021 lists loss of geolocation as a CGN side effect, because many customers in different places leave the ISP from the same public address.
• Address rotation: Cloudflare warns that on mobile or CGNAT networks an address can change again before a location correction is even processed.
• VPNs and proxies: the database can only locate the VPN server, not the person behind it.
• ISP equipment: the location often belongs to the city where the ISP's equipment is, which is why the What is my IP page labels its location as approximate.