IP Geolocation

The country is usually right. The city often is not.

There is no measurement in IP geolocation. Nothing about an address encodes where it is — the data is a commercial database built from registry allocations, what ISPs publish, reverse DNS conventions and latency inference. So accuracy collapses as precision rises: the country is right the great majority of the time, the region much less often, and the city is frequently the ISP's nearest point of presence rather than anywhere near the subscriber.

• Whole regions collapse onto one gateway. Mobile carriers route large areas through a few of them, so a phone appears hundreds of kilometres away. Satellite and some business links appear at the operator's headquarters, and a corporate VPN relocates every user to the datacentre terminating it.
• The coordinates are almost never a point. Knowing only the country, many providers return that country's geographic centre — which is how ordinary addresses end up pinned to an empty field, a documented consequence that has caused real harm to people living at those coordinates.

What this result cannot support

• It does not identify a person or a premises. One address is routinely many subscribers: carrier-grade NAT, a shared office, a university, a cloud NAT gateway. Only the ISP can map an address at a point in time to a subscriber, from its own logs, and in most jurisdictions only under legal process.
• A "foreign" country is not an incident. It is the most over-weighted signal in security operations. Cloud egress, VPN, a CDN or a mail provider relaying for the user all produce it — and so does a stale row nobody has updated since the range moved to a different RIR.
• The timezone belongs to the guess, not to the user. Derived from the inferred location, so a timeline built on it inherits every error above. Take the timezone from the log source's own configuration, or stay in UTC.
• A blank query does not report your address. The lookup is server-side, so with no address supplied the provider reports the server that asked — PermitANY's, not yours. Type the address you want.

The fields, by how much weight they carry

The ASN is the field to trust and the one people ignore. It is not inferred — it is the routing system's own answer to who announces this prefix — and it settles the question that usually matters: access network where a human might plausibly be, or datacentre where one would not be? That decides more triage outcomes than the city name ever will, and it does not degrade over time the way a city mapping does.

When to use something else

For the registry record rather than a commercial inference — who holds the block, since when, under which RIR — the WHOIS lookup is authoritative where geolocation is only probable. For whether the address has a history, IP reputation adds abuse reports and threat-intel-lookup does many indicators at once.

If you arrived from a log line, the order matters more than the lookup: soc-analyst-workflow puts geolocation where it belongs — as context, late — and log-timeline-builder builds the UTC timeline without assuming a timezone from an address.