What is IP Geolocation? How does it work?

Introduction

IP Geolocation or GeoIP, is the capability of deducing the geographic location of a device connected to the Internet through the IP Address of that device.

This approach is being used so many years ago by the leading companies on the Internet and the main reason for that is the ability of knowing more information about their customers (visitors).

In this article we'll be discussing everything you need to know about IP Geolocation or GeoIP, how does it work and the use cases of this kind of services.

What is an IP Address?

An Internet Protocol address (IP address) is a numerical label such as 192.0.2.1 that is connected to a computer network that uses the Internet Protocol for communication.

The main functions of an IP Address are identifying the host, or more specifically its network interface, and it provides the location of the host in the network, and thus the capability of establishing a path to that host. Its role has been characterized as follows: "A name indicates what we seek. An address indicates where it is. A route indicates how to get there."

What are the use cases of IP Geolocation?

There are many systems are using IP Geolocation services to get benefit from the information it provides, which some of them are:

• Geomarketing: Provide web content or products that are famous or useful in that specific location;
• Content Localization: Personalizing web content according to the geographical location of the visitor. For example: showing the Arabic version of the website for the Arab visitors, or showing the UK version of the website for the visitors came from United Kingdom;
• Analytics purposes: IP Geolocation service might be used for analytics purposes as well. For example: the website owner can know more about the website audience;
• Criminal investigations: Banks, software vendors and other online enterprises in the US and elsewhere became subject to strict "know your customer" laws imposed by the USA PATRIOT Act, the Bank Secrecy Act, the US Treasury Department's Office of Foreign Assets Control and other regulatory entities in the US and Europe from the early twenty-first century. These laws are intended to prevent money laundering, trafficking with terrorist organizations, and trading with banned nations. When it is possible to identify the true location of online visitors, geolocation can protect banks from participating in the transfer of funds for illicit purposes;
• Fraud Prevention: Online retailers and payment processors use geolocation to detect possible credit card fraud by comparing the user's location to the billing address on the account or the shipping address provided. A mismatch – an order placed from the US on an account number from Tokyo, for example – is a strong indicator of potential fraud; and
• Enforcing Policies: GDPR compliance or any other terms / policies being applied according to the visitor's location.

IP Geolocation is not designed to be a harmful tool that can be used to locate a device of something like this. It's a very helpful way that many institutions and organizations use to get benefit of the data it provide by PERSONALIZING the website/app for it's users in accordance with their needs, or to enforce some policies to their visitors/users.

The services are used in legitimate and important business practices in a variety of industries, including banking, telecommunications, travel, hospitality, entertainment, and law enforcement. Banks themselves prevent “phishing” attacks, money laundering, and other security breaches by determining the user’s location as part of the authentication process.

How does IP Geolocation services work?

IP Geolocation services are being used to show the geographical location of a device connected to the Internet. This kind of services cannot fetch the exact information of the user's actual location. It just shows an approximate location (just an estimation).

And it's not possible to fetch the exact information of a specific IP Address is because that there's no way to get a real-time location information of an IP Address – Internet Protocol Address (IP Address) is not designed for the purpose of identifying the exact location of the device.

Almost all IP Geolocation services works by searching for a given IP Address in some databases that contain the location data for each IP Address listed in these databases.

This is just a simple way to explain the way that these services work. For example, we – as an IP Geolocation Service provider – are trying to get the deepest data possible from the given IP Address.

This is done by using our especially designed technology for gathering the most accurate information possible by both searching in databases and also using some algorithms developed for achieving this goal.

So, we can classify IP Geolocation Services into two main types [4]:

1. Static techniques

This is the most popular type (almost all IP Geolocation service providers use these techniques) which can be either using a database contains a list of IP Addresses with it's geographic location data or using Domain Name Service (DNS) names of the nearby routes to geolocate an IP Address. These techniques can be described as follows:

• Using a database, also called "Database Lookup": is a database contains a list of IP Addresses with it's geographic location information. These information are usually gathered from "Public WHOIS Databases", which provides information about the registrant or assignee of an IP Address block. But, these information (WHOIS databases information) might be incomplete, obsolete, or inaccurate. Further, if a large block of IP addresses is allocated to a single entity, then the WHOIS database does not provide information about the geographic location of individual IP addresses within that block. However, such databases are difficult to build and maintain. Since service providers regularly refresh IP addresses of their customers, these databases need to be updated frequently as well.
• Domain Name Service (DNS): is an alternative approach of geolocation which based on extracting geographic information of the IP Address from the DNS name of the end-host or a nearby routes. Network operators often assign domain names to the network routers embedded with geographic codes. Extracting and identifying these geographic codes from a network router in the vicinity of the target can provide a useful estimate of its geographic location. However, this approach is not reliable since not all routers have descriptive names. Moreover, since there is no standard for naming the routers, identifying this information can be a challenging task.

2. Measurement based techniques

Measurement based geolocation involves active measurements of RTTs to a target IP address from a machine at a known location. The Internet Control Message Protocol (ICMP) echo requests (pings) are used to collect RTT values between a pair of machines. These techniques assume that RTTs and distances between machines are correlated.

This is just a simple way that we can describe this type of techniques. It's more complicated than this definition and we strongly recommend following the references below to know more about this type of techniques.

Conclusion

IP Geolocation service is being one of the most important part of each website or application these days. This is because of the high importance information that it provides. Most websites or applications need to enforce some important policies like GDPR, personalizing content or prevent their systems from any fraud or abuse. All these use cases and many others can be achieved by using an IP Geolocation Services.

Again, we strongly recommend following the links below (in the References section) so you can get more information of IP Geolocation use cases and how does it work in the deepest meaning.

References

1. Internet geolocation - Wikipedia
2. IP address - Wikipedia
3. What is IP Geolocation and How Does It Work?
4. IP Geolocation in Metropolitan Areas