RE: Geofeeds are adversarial — was Re: Geofeeds are good

[Gary Sparkes via NANOG <nanog () lists nanog org>]

Interesting results I'm getting here on a variety of ranges.....

I'm testing 5 different nets, one residential ISP /24, two of my own /24's and two /48's (from the same /36). Of those, 
the first each of the /24 and /48 have geofeed data, the second two do not (I will be fixing that)

Of these, I'd give DB-IP the highest marks, and the most reliable data. 

But that's still, to me, a wild amount of discrepancies for the two prefixes I had current geofeed data up (for almost 
a year now!) between some providers

Maxmind, gave....
Residential /24 -> Correct local town
2nd Owned /24 -> US, NA
1st Owned /24 -> US, NA
1st Owned /48, -> US, NA
2nd Owned /48, -> US, NA

Using iplocation.net to query: (I did double check these with ipinfo's own tool to make sure their results presented 
were accurate responses for them)

Residential /24: 

IP2Location: Wrong state, ARIN org fallback data.
Ipinfo.io: Same wrong state, correct state for ARIN org fallback data, but wrong town for ARIN data (?)
DB-IP: Correct
IPregistry.co: Same as IPinfo
IPGeolocation.io: Same state as ARIN org fallback data., but unrelated town
IPapi.co: Correct state, nearby town - close enough
Criminalip.io: Correct


1st owned /24: 
IP2Location: Correct
Ipinfo.io: Incorrect, by about 2500-3000 miles
DB-IP: ARIN fallback data, it seems
IPregistry.co: Correct
IPGeolocation.io: Correct
IPapi.co: ARIN org fallback data.
Criminalip.io: N/A

2nd owned /24:
All identical, ARIN org fallback data.
Criminalip.io: N/A

1st owned /48:
All correct.

2nd owned /48:
All ARIN org fallback data except:
IPapi.co: Incorrect, by about 2500-3000 miles

-----Original Message-----
From: Abdullah DevRel of IPinfo via NANOG <nanog () lists nanog org> 
Sent: Monday, February 16, 2026 12:29 AM
To: nanog () lists nanog org
Cc: Abdullah DevRel of IPinfo <devrel.ipinfo () gmail com>
Subject: RE: Geofeeds are adversarial — was Re: Geofeeds are good

Hi Tony,

> I compared IPinfo's answers to MaxMind's answers, for a random recent visitor from 44.198.66.156 to my website and 
> one notable difference is that you specify a larger CIDR block of 44.192.0.0/11 (2,097,152 addresses) whereas MaxMind 
> specifies a much smaller CIDR block 44.198.64.0/19 (8,192 addresses).

That is an AWS IP address, and it brings up an interesting point.

The /11 we display reflects the actual BGP announcement for that IP. You can verify this yourself on bgp.tools: 
https://bgp.tools/prefix-selector?ip=44.198.66.156

bgp.tools shows two overlapping prefixes for that IP:
- AS14618: 44.192.0.0/11 (High visibility)
- AS16509: 44.192.0.0/10 (High visibility)

There is no /19 announcement visible in the BGP routing table for that IP. The /19 that the other provider displays 
appears to be derived from a source other than BGP, possibly their own internal prefix segmentation or geofeed data.

We show the BGP-announced prefix because that reflects how the IP address is actually routed on the internet. The 
geolocation data (city, country) is determined separately from the CIDR displayed on the page, so the larger prefix 
does not mean less granular geolocation.

— Abdullah | DevRel, IPinfo
_______________________________________________
NANOG mailing list 
https://lists.nanog.org/archives/list/nanog () lists nanog org/message/4RKVQ44QVZ3GCLE6ELHXIJTSK3Q7VHFQ/
_______________________________________________
NANOG mailing list 
https://lists.nanog.org/archives/list/nanog () lists nanog org/message/XO2ZAXT7TFZURBMW7VQV3DG3FBZNYLJN/