IP Geolocation

IP geolocation is the process of mapping an IP address to an estimated physical and network location. It usually returns a country, region, city, postal area, latitude and longitude, timezone, internet service provider, autonomous system number, and sometimes a connection type such as residential, mobile, hosting, proxy, VPN, or Tor.

The result is an estimate, not a GPS position. IP addresses are assigned to networks, routed through internet providers, moved between data centers, and reused across customers. A lookup can identify that traffic is likely coming from Germany, a mobile carrier, or a cloud hosting ASN, but it usually cannot prove the exact person, device, street address, or building behind the request.

How IP geolocation works

Geolocation providers combine routing data, regional internet registry records, BGP announcements, ISP allocation data, latency observations, reverse DNS hints, user-contributed measurements, and commercial corrections. These sources are normalized into range databases that map CIDR blocks or individual IPs to location and network metadata.

For IPv4, databases often map relatively small address ranges. For IPv6, assignments are larger and can be less precise because providers delegate wide prefixes to customers, mobile networks, or infrastructure systems.

Common fields

• Country and region: Useful for localization, tax logic, shipping eligibility, sanctions screening, and coarse fraud checks.
• City and coordinates: Best treated as approximate. They are useful for risk scoring and analytics, not exact identity.
• ASN and organization: Shows the network operator, such as a cloud provider, ISP, enterprise network, or mobile carrier.
• Connection type: Helps distinguish residential, mobile, hosting, proxy, VPN, Tor, and other network classes.
• Timezone: Can be compared with browser or account timezone signals to detect mismatches.

Fraud and security use cases

IP geolocation is most useful when combined with other request intelligence. A checkout from a billing country that does not match the IP country, an account login from a new ASN, or a signup using a disposable email from a data center IP can all raise risk. The signal is stronger when it agrees with device, email, domain, velocity, behavior, and payment signals.

It should not be used as the only reason to block a user. Travelers, VPN users, corporate gateways, mobile carrier NAT, satellite networks, and privacy tools can all create legitimate location mismatches.

Accuracy limits

Accuracy varies by country, network type, and provider. Country-level accuracy is usually the strongest. Region and city accuracy are weaker, especially for mobile networks, VPNs, carrier-grade NAT, cloud infrastructure, and recently reassigned IP space. Enterprise networks may also route traffic through centralized gateways that appear far away from the user.

Good systems treat geolocation as a confidence-weighted signal. They record the source, timestamp, ASN, and confidence level, then combine the result with other evidence before making a decision.

RequestGuard context

RequestGuard uses IP geolocation as part of broader IP intelligence and fraud decisioning. The signal helps explain where a request appears to originate, which network owns the address, whether the address belongs to hosting or consumer access infrastructure, and how the IP compares with account, email, domain, device, and behavior signals.