IP Geofeeds: Trust, Accuracy, and Abuse#

Calvin Ardi — IPinfo (with Oliver Gasser, William Leung)

• Why: Self-published IP geolocation (RFC 8805) is now consumed by every major geolocation provider and feeds compliance decisions (gambling law, content geo-blocking) — and this is the first large-scale measurement of whether geofeeds are true, plus documentation of active adversarial abuse of the format. Not a typical PM search topic, but the findings are broadly useful.
• What: Validation via two methods: RTT multilateration from a ~1,300-probe global network (27.7M RTTs covering 205k IPv4 / 74.5k IPv6 prefixes) and GPS ground truth from mobile devices. Results: country-level consistency 92% (96.6% IPv4, 79.6% IPv6), but city-level only 79.6% for infrastructure measurements (median error a startling 759 km) and just 29.9% on mobile networks — the gap between infrastructure location and actual user location. Top mismatch sources: CDNs, tier-1s, VPNs, cellular, IP leasing. Adversarial geofeeds are real and quantified: one maps ~101k IPv6 prefixes to 249 countries and ~80k cities (including Antarctica and North Korea); 17 of 20 popular VPN providers had exit traffic in a different country than claimed; public guides exist for crafting metadata to manipulate geolocation databases.
• How: Proposals to fix the ecosystem: format updates (validity periods/TTL, standardized location identifiers such as H3), validation and feedback mechanisms (geofeed-validator, OpenGeoFeed), and public/private hosting options — with an IAB workshop and possible future IETF WG.
• Where applicable: Anyone publishing geofeeds (the companion best-practices talk gives authoring guidance) or consuming geolocation for compliance/security. The mobile-network city-level number is the one to remember when someone proposes city-level geo-enforcement.