IP Address Cannot Prove
Where Someone Is

When you go online, your internet provider assigns your device an IP address from a pool it controls. When you visit a website or an exchange, they see that IP and ask a database: "where is this person?" But the IP address contains no location; the IP is a routing label, not a coordinate. The database's answer comes from what the owner of that IP block declared: registration records and geofeed files that say "these addresses are in this country." If the declaration is wrong or outdated, the answer is wrong. IP geolocation is not a measurement of where someone is. It is an inference built on self-reported data — and the underlying protocol was never designed to encode location. IP addresses are used for geolocation not because the method works, but because GPS is trivial to spoof and often not available — no better passive signal existed.

Fixed broadband is the most accurate connection type: the cable ends at a known physical address. Mobile, VPN, and satellite traffic are the connection types most likely used in sanctions-risk geographies. Click any card for sources.

The primary inputs to IP geolocation databases are self-declared: the holder of an IP address selects a country in WHOIS records and publishes RFC 8805 geofeeds (CSV files that say "this prefix is in this country"). WHOIS has no verification process for geographic accuracy. Geofeeds are explicitly "self-published" — RFC 8805 itself says consumers MAY treat them as a hint only. Research confirms geofeeds contain 8% wrong country-level data and 20.4% wrong city-level data (IPinfo, 2025). Some providers attempt independent verification through active probing — pinging IP addresses from distributed servers and triangulating location from round-trip times — but this technique cannot reach most consumer devices, which sit behind NAT or carrier-grade NAT and drop unsolicited probes (Fainchtein & Sherr, 2024; RFC 8805). For the mobile IPs that dominate sanctioned-country traffic, databases fall back to the self-declared data.

Satellite internet breaks IP geolocation at every layer. The user connects to an orbiting satellite, which downlinks to a ground station, but the IP address does not resolve to the ground station. It resolves to the Point of Presence (PoP), a routing hub connected by terrestrial fiber. Pan et al. (Dec 2025) mapped 5.98 million Starlink routers and found the entire global network funnels through just 49 PoPs serving 165 countries. Users in countries with a local PoP (US, UK, Germany, Brazil, ~49 total) get ~95% country accuracy because traffic stays domestic. Users in the remaining 100+ countries route through foreign PoPs: Africa through Frankfurt, the Caribbean through Miami, the Pacific through Sydney. For these users, the IP address belongs to a server in a different country. Starlink publishes a GeoFeed file that tells databases "this IP is actually in Kenya, not Germany," but the IETF (Nov 2025) found it is manually maintained, prone to errors, and databases cache it for days or weeks while Starlink shuffles IPs constantly. All sanctioned countries fall in the no-PoP tier. Starlink went from zero to 10 million subscribers in four years on ~10,000 satellites. It has FCC authorisation for 42,000. Two more constellations are entering the market: Amazon Leo (7,774 satellites authorised, beta 2026) and Blue Origin's TeraWave (5,408 satellites, FCC filing January 2026). If all three deploy to plan: 55,000+ LEO satellites providing internet connectivity, a fivefold increase from today, all routing through a few dozen ground-based PoPs. Every new subscriber in a sanctioned country is another connection where IP geolocation depends on a manually updated spreadsheet.