How IP Geolocation Actually Works (and How Accurate It Is)

Type your IP into a lookup tool and it shows your city, your ISP, maybe your coordinates. How does a bare number like 203.0.113.7 reveal any of that — and when should you trust it?

Where the data comes from

There's no GPS chip in an IP address. Geolocation databases (MaxMind, ipinfo, DB-IP) build their maps from: RIR allocation records (ARIN/RIPE/APNIC publish which organization owns each block), ISP disclosures (many ISPs publish city-level prefixes), latency triangulation (measuring ping times from known locations), user-submitted corrections, and web server location data. The result is a giant periodically-updated table: prefix → best-guess location.

Realistic accuracy rates

• Country: ~99% — allocation records are reliable at this level.
• Region/state: ~80–95% — good in dense networks, worse where ISPs pool regions.
• City: ~60–80% — fine for broadband; your phone on mobile data often geolocates to the carrier's gateway city, not yours.
• Street address: never. Residential IPs will not place you at your house.

The VPN and proxy problem

A VPN subscriber shows the exit server's location. Someone in Kathmandu on a Frankfurt VPN looks German to every geolocation tool. Commercial databases flag many known VPN/proxy/hosting ranges as such — when you see hosting: true or an org name like a datacenter, treat the location as "where the tunnel ends, not where the human is."

Legitimate uses

Fraud screening (billing country vs IP country mismatch is a classic alarm), content localization (default language/currency guesses), rate-limiting by region, and analytics dashboards. Our IP lookup tool queries ipwho.is and shows the raw JSON too, so you can see exactly which fields the database provides — including the VPN/hosting flags.

The privacy angle

Your IP is semi-public: every site you visit sees it. It exposes approximate location and ISP but not identity — ISPs hold the subscriber mapping and only release it under legal process. Still, combined with browser fingerprinting and a login, an IP is a solid pseudonymous identifier, which is why GDPR classifies it as personal data and why privacy-conscious users reach for VPNs.