IP Lookup and Geolocation: What an Address Reveals — and What It Does Not

An IP address is the cheapest intelligence object on the internet: one lookup yields the network that owns it, where that network is registered, and whether it serves end users or servers. Knowing what those answers mean — and their limits — keeps geolocation useful without letting it make decisions it cannot support.

What a lookup returns

• ASN and network name: the autonomous system announcing the address. AS16509 Amazon reads very differently from AS7922 Comcast: the first is a datacenter, the second is a home broadband user.
• Hosting type: datacenter/hosting, residential, mobile, or business. This single attribute does more triage work than city-level geolocation ever will — logins from hosting ranges are a standing anomaly worth attention.
• Country: derived from registry allocation and routing data. Accurate the overwhelming majority of the time at country level.
• City and coordinates: inferred from the network’s registered location. This is where databases disagree with reality: a phone carrier’s IPs may geolocate to its headquarters city for every subscriber nationwide, and a CDN edge in Frankfurt may be registered to a US range.

The DNS side of the same interrogation, useful for hostnames:

dig +short -x 203.0.113.7
whois 203.0.113.7

Accuracy limits, stated plainly

Country-level GeoIP is reliable; city-level is an estimate that is sometimes wrong by hundreds of kilometres. Postal codes and precise coordinates from free databases should be treated as fiction. Databases also lag: newly allocated ranges default to the registry’s country, corporate VPN exits skew results, and mobile CGNAT pools compress an entire country into a few registered cities. Two databases disagreeing about the city of the same IP is normal and expected.

GeoIP as one signal in triage

Used properly, geolocation feeds a scoring process rather than issuing verdicts:

1. Impossible travel: a login from Tokyo 40 minutes after one from Berlin is decisive regardless of city accuracy — the countries alone suffice.
2. Hosting vs residential: successful logins from datacenter ASNs deserve a step-up challenge; millions of legitimate users behind a mobile ASN do not.
3. Sanction/embargo screening: country-level is exactly the right granularity here, which is why compliance tools use it.
4. Abuse triage: for spam or scraping, check whether the IP is on a blocklist and whether it is dynamic residential (block the behaviour) or a datacenter VPS (block the range or demand auth).

Corroborate with independent signals — device fingerprint, account age, request pattern — and never auto-block on city data alone, or the support inbox will fill with users whose ISP routes through the wrong metro area.

The IP and GeoIP lookup on WhoDNS combines ASN, hosting classification and country for any address using its local offline GeoIP database — the quick, no-API-key lookup that turns a bare IP in a log line into a network, a country and a next step.