July 17, 2026
IP geolocation is a guess — treat it like one
I have been in meetings where someone put a pin on a map and called it evidence. The pin came from an IP geolocation API. The prefix was anycast. The “city” was a POP the user had never visited. We still spent twenty minutes talking about that pin.
Geolocation is a guess with a vendor logo. It is often a good guess at the country level. It is frequently a bad guess at the city level. It is almost always a lie at the street level, unless you are a mobile carrier with GPS consent, which you are not when you are looking at a /24 on the public internet.
Why the databases disagree
Each vendor builds a different stew: RIR SWIP, latency measurements, user-submitted corrections, WHOIS, and whatever they bought last year. A prefix that moved from a Dallas colo to a Frankfurt colo six weeks ago will be “Dallas” in one database and “Frankfurt” in another until the slow one catches up. That is not incompetence. That is cache.
This is why I never use a single provider for anything I might have to defend. On our geolocation lookup I want the table: same IP, many opinions. If seven vendors say Germany and one says Virginia, I write “probably Germany” and I move on. If they split 4–3, I write “unknown” and I refuse to decorate a slide.
Anycast, CGNAT, and other map-killers
Anycast prefixes are in many cities at once. The “location” is whichever node answered the vendor’s probe. CDN space will jitter across oceans depending on who asked. CGNAT means thousands of humans share an address that geolocates to a carrier POP, not a house. Mobile gateways sit in a handful of cities for an entire country.
If the IP lookup shows a covering prefix announced by a big CDN or a mobile ASN, I stop talking about neighborhoods. I talk about networks.
Category is the column I actually use
City is theater. Category is operational. Residential, cloud, hosting, VPN/proxy, education, government — those labels change how I treat the traffic. A spike of logins from a cloud /24 is a different conversation than the same spike from a residential cable prefix. A VPN exit is not “the user is in that city.” It is “the user is hiding, or their employer tunnels everything, or both.”
I still treat category as a guess. Vendors misfile university dorms as residential and misfile some residential ISPs as hosting because the WHOIS says “LLC.” But as a prior, category beats city. Every time.
How I write it down so I do not lie later
When I put geo in a ticket I write three lines: country (with dissent if any), category, and the prefix + origin ASN. I do not write a street. I do not write a timezone as if I measured it. If someone needs a legal location they can go get a warrant and ask the access network. My job is routing and context, not cartography.
Bulk lookups are for the days you have a hundred addresses from a login flood. Paste them, sort by category, and ignore the pretty flags until the categories tell you whether you are looking at a botnet on cloud VPS or a campus that just enabled a broken resolver.
Use geolocation. Just do not let it talk you into a story the prefix cannot support.