What Is IP Geolocation?

IP geolocation is an estimate of a device's physical location based on its IP address. The estimate comes from third-party databases and published records, not from any location data carried in the packet itself. Different sources can and do disagree about the same address.

Services use geolocation for things like showing local pricing, applying regional content rules, or flagging a login from an unexpected country. Understanding that it is an estimate, not a measurement, explains why it is sometimes wrong and what you can do about it.

How is an IP address's location estimated?

No location field exists in an IP packet. A geolocation result comes from matching the address against external data compiled from several kinds of sources:

Registry data such as ARIN's Whois service is authoritative about who holds a block and where that organization is registered. It is not necessarily where the traffic using that block actually originates, which is a distinct question addressed below.

Why do different geolocation lookups disagree?

Commercial databases update on their own schedules, use different underlying signals, and apply different inference methods. Two reputable services can therefore return different cities or even different countries for the same address, especially soon after a block changes hands or is deployed somewhere new.

A single address block can also serve traffic from a wide area. A cloud provider's range might be announced from one region while the provider's registered corporate address is elsewhere. An anycast service, covered in our anycast vs unicast guide, can announce the same address from multiple physical sites at once, so "the location of that address" is not a single answer at all.

Does the registry country tell you where traffic comes from?

Not reliably. The registered holder's address in RIR records reflects who is accountable for the block, not necessarily where connecting devices are. A multinational ISP, a leased range, or a BYOIP deployment can all mean the registrant's country differs from where the actual traffic originates. Our who owns an IP address guide covers the distinction between registration and use.

Treat registry country as one data point about accountability, not a geolocation result.

How do you correct a wrong geolocation result?

Because there is no single authoritative geolocation service, correcting a result usually means contacting each vendor separately, and there is no guarantee every vendor will update on the same timeline.

RFC 8805 defines a standard format, commonly called a geofeed, that lets a network operator publish the location it asserts for its own address ranges in a machine-readable file. Some geolocation vendors and registries ingest these self-published feeds, which can improve accuracy faster than filing individual correction requests. RIPE NCC's geofeed documentation shows how a regional registry can reference an operator's geofeed from its own records.

Publishing a geofeed does not force every commercial database to adopt it immediately. Vendor coverage and update cadence vary, so plan for a correction to take time to propagate.

Why does this matter after a BYOIP migration?

When you move your own address block to a new cloud provider or a new region, geolocation databases do not know that has happened until their data is refreshed. Traffic from your addresses can continue to geolocate to the old deployment's location for a period after the move, which can trigger unexpected fraud checks or regional content mismatches for your users.

Publishing an updated geofeed for the migrated range, and checking with major geolocation vendors directly if the mismatch affects your business, is a practical step after a BYOIP migration, alongside the routing and DNS changes you would already expect to make.

FAQ

Related resources