QueryBox networktoolkit.io

IP Geolocation Lookup

Map an IP address to a country, region, city, and ISP using multiple GeoIP databases.

Run a live IP location lookup from global worker nodes Try IP location on QueryBox →

TL;DR

IP geolocation maps an IP address to a physical location by querying curated databases that associate IP prefixes with geographic regions. Country-level accuracy is high (95–99%). City-level accuracy is much lower (50–80%). Coordinates are centroids, not precise locations.

What it is

Every public IP address belongs to a network range (a prefix) that has been assigned to an organisation by a Regional Internet Registry (RIR). GeoIP databases link those prefixes to geographic locations based on registry records, active measurement, and feedback corrections.

IP location is used everywhere: streaming services apply geo-restrictions, CDNs route users to nearby edge nodes, fraud systems flag unusual locations, and analytics platforms report where users come from. The accuracy and ethics of all of these depend on understanding what GeoIP can and cannot do.

How it works

GeoIP databases are built from multiple sources:

  • RIR WHOIS data: who was assigned a prefix and the country they operate from
  • BGP routing data: which ASN announced the prefix, and where that ASN's infrastructure is
  • DNS reverse PTR records: hostnames often encode location (e.g. lo1.pe.lax-01.example.net)
  • Active measurement: round-trip times to known points triangulate likely location
  • User and ISP corrections: operators can submit corrections to major database providers

The databases are updated continuously. MaxMind GeoLite2, IP-API, IPinfo, and ipdata are commonly used providers, each with its own methodology and accuracy profile.

When to use it

  • Audit what location your server's IP shows to CDNs and geo-routing services
  • Verify a VPN exit node geolocates where expected
  • Confirm a CDN IP geolocates to the right pop for a region
  • Identify who controls an IP address (ASN, ISP, organisation)
  • Diagnose why a geo-restricted service redirects you to the wrong country version
  • Security incident response: characterise an attacking IP's network and region
  • Cross-region: run a geolocation lookup from each of our worker nodes to see what location they are assigned

Running it on networktoolkit.io

Select ip_location, enter an IP address or hostname, and the lookup runs against multiple GeoIP databases from each of our distributed workers. Sample output:

Target:   93.184.216.34

Database: MaxMind GeoLite2-City
  Country:  United States (US)
  Region:   Massachusetts
  City:     Norwell
  Lat/lon:  42.1596, -70.8217 (approx)
  Timezone: America/New_York

Database: IPinfo
  Country:  United States (US)
  Region:   Massachusetts
  City:     Norwell
  Lat/lon:  42.1596, -70.8206

Network:
  IP:       93.184.216.34
  Prefix:   93.184.216.0/24
  ASN:      AS15133 (Edgio)
  ISP:      Edgio
  Type:     hosting / CDN

Reading the results

FieldMeaning
CountryISO country code and name — the most reliable field
RegionState or province — reliable for most residential IPs
CityApproximate city — accuracy varies widely, especially for mobile and corporate
Lat/lonApproximate centroid for the IP block, not a precise coordinate
TimezoneDerived from the country/region mapping
PrefixThe CIDR block the IP belongs to
ASNAutonomous System Number of the announcing network
ISP / OrgWho operates the ASN
TypeResidential, hosting, CDN, corporate, mobile, VPN exit

Accuracy expectations

GranularityTypical accuracyNotes
Country95–99%Very reliable; the only level suitable for compliance decisions
Region / State70–90%Reasonably reliable for most ISP residential allocations
City50–80%Degrades significantly for mobile, corporate, and cloud IPs
Postal code40–60%Rarely reliable enough for decisions
CoordinateCentroid onlyNot a building address; often the city centre or ISP office

Limitations & gotchas

  • VPNs, proxies, and Tor exit nodes geolocate to the exit server's location, not the user. The "Type" field in GeoIP data often flags these as VPN or hosting IPs.
  • Mobile networks route traffic through central gateways that may be hundreds of kilometres from the user's physical location.
  • CGNAT (carrier-grade NAT) means a single IP may represent thousands of users in different cities.
  • Cloud and CDN IPs are geolocated to data centres, not to any user using that service.
  • Different databases disagree. Running against multiple providers is the best way to gauge how settled a particular block's location is.
  • Data freshness matters. IP blocks are reallocated. An IP assigned to one country three years ago may now belong to another. Check the prefix assignment date in WHOIS.

Security & privacy notes

IP geolocation exposes approximate physical location. For users, this is a privacy consideration: websites can infer region from IP without asking. For operators, the asymmetry works both ways — you can infer where your users are coming from, but you cannot confirm individual identity or precise address.

The "Type" field (residential / hosting / VPN) is particularly useful for fraud detection: a payment from a "VPN" or "hosting" IP warrants additional verification steps.

Standards & references

FAQ

How accurate is IP geolocation?

Country level is very reliable: typically 95–99%. City level is much weaker, often 50–80%. Coordinates are a statistical centroid for the IP block, not a building address. Accuracy drops further for mobile networks, VPN exit nodes, and corporate proxy addresses.

Why does my IP location say the wrong city?

The IP block may be geolocation-mapped to your ISP's regional hub or DHCP allocation office rather than your actual city. GeoIP data is built from ISP registry data, active measurement, and user corrections — it is inherently imprecise below the city level.

Can someone find my home address from my IP?

No. Public GeoIP data shows an approximate city or postcode, not a street address. Home addresses can only be obtained by ISPs when compelled by legal process.

Why does the same IP return different locations from different providers?

Different GeoIP databases use different data sources, update frequencies, and measurement techniques. Country-level answers are almost always consistent; city-level answers routinely differ between providers by tens to hundreds of kilometres.

What is an ASN and why is it shown alongside the location?

An Autonomous System Number (ASN) identifies the network operator that announced the IP prefix via BGP. It tells you who controls the IP range. ASN context often explains geolocation quirks — for example, a CDN IP geolocates to a data centre city, not the end user.