September 4, 2026
Why GeoIP Thinks You Work in Ashburn, Virginia
Ashburn is a real place with real buildings. It is also a gravitational joke. Anycast prefixes, cloud regions, and lazy database defaults collapse half the commercial internet into Loudoun County. Your fraud tool then decides a user “traveled 4,000 miles in four minutes.” They did not. Your map did.
Where city labels actually come from
Geolocation vendors mix RIR records, latency probes, user-submitted corrections, and tradition. Tradition says large IPv4 blocks bought by cloud and CDN companies “are” in Northern Virginia. Anycast then puts that same block everywhere. The database does not clone the row. Your SIEM does the rest.
How to locate a prefix like an operator
- Look up the address. Trust origin ASN and prefix first.
- Read RDAP for the allocating org, not the city hint.
- Use a looking glass next hop as a hint of which region heard what.
- Use global ping as a latency map, never as a passport.
If pings are 8 ms from Paris and 90 ms from Dallas, you did not “move the user to France.” You hit a European PoP. Write that sentence in the ticket. Do not write “user is in Paris.”
AI products amplify the joke
Model gateways and crawler pools sit on famous prefixes. Content filters that ban “Virginia datacenters” will ban half of useful automation and almost none of a determined person on residential LTE. If you must geo-restrict, do it at the application layer with logged exceptions. Do not pretend a city field is a border.
Look up a “Virginia” address from your last fraud alert. If the origin is a CDN ASN, the city was a default, not a detective.
FAQ
Is GeoIP ever useful?
As a coarse continent guess for content licensing, sometimes. As identity, no.
Why does my own home IP show the wrong town?
CGNAT pools and outdated ISP records. The ASN is still your ISP. Believe that.