tl;dr it requires owning your own IP blocks and then lying.
> In reality, the “location” of an IP is inherently fuzzy. For instance, my 2a14:7c0:4d00::/40 block was originally allocated to Israel. But later, I bought parts of this range and announced them via BGP in Germany, the US, and Singapore (see previous article on Anycast networks). Meanwhile, I’m physically located in mainland China. As the owner of this IP block, I can also freely edit the country field in the WHOIS database — and I set it to KP (North Korea).
> Because of this ambiguity, it’s nearly impossible to precisely determine an IP’s location using any single technical method. As a result, almost all geolocation databases accept public/user-submitted correction requests.
I would not be surprised if this practice is technically against most terms of service.
> tl;dr it requires owning your own IP blocks and then lying.
If this was the case, and theres tons of financial incentive to do so, wouldnt cloudflare,etc, block not based on the reported 'country' but some fuzzy heuristic that knows what country it comes from? hops?
Yeah Geo-IP is "fake" when I look at this deeper, idk why people use this as source of truth
also important point when you using Starlink and got totally different "relay" station sometimes can be thousand miles away, I think we need to "upgrade" our internet infrastructure for interplanetary system
I've wanted to try something like this before, but I was under the impression that providers like MaxMind might use other techniques to figure out the "real" location of a server.
ipinfo.io uses a probe network for this[1], but even then a server physically located in the Netherlands with an IP announced as being from, say, Seychelles would still respond to pings faster from a European location than from somewhere like Singapore (unless you go out of your way to induce latency to ICMP responses).
Thank you for mentioning us. I work for IPinfo. We perform a combination of a ping and a traceroute to understand how packets travel through the internet so that we can determine the location of the IP address. Our objective is to map the entire internet.
However, ideally, we should have a PoP in Seychelles. Some of our recent expansions have been in offshore territories.
This is a great post, I was asking about this for asn location to ChatGPT and it was telling me it wouldn’t help on this request lol.
But thanks to this series I setup an ARIN account, got allocated ipv6 and ipv4 addresses and starting the ASN assignment process. It’s a fun rabbit hole to go into.
surprised to see a p3terx blog referene here. His CF WARP scripts were quite popular.
Some background info: in China, all online discourse are required to show the user's provincial-level origin, or country name for non-mainland users, using geoip. this is enforced by the Cyber Admin Commission of CCP.
My first thought was "is this legal?", but then had a hard time considering even which jurisdiction this (or using a "fraudulent" IP location) would fall under?
I work for IPinfo. Creating adverserial geofeeds is not illegal — it's just frowned upon at best. We treat geofeeds as self-reported location data, and we do not assume they are trustworthy.
This is exactly why, unlike much of the industry, we maintain a large team across engineering, data engineering, data science, and research, along with a substantial data-processing infrastructure and 1,200+ servers. Our entire purpose is to verify location data rather than simply aggregate, parse, and repeat whatever is self-reported. Otherwise, it’s just GIGO.
Even though we came up short in this particular case, we are actively pushing updates right now that eliminate these issues going forward.
I saw a few documentaries about North Korea. Now, I'll skip the potemkin-village propaganda part of the regime, but I was quite surprised that they had skilled developers too and modern equipment / computers. Granted, this was an exception (Pyongyang is an exception in general anyway) and naturally in these documentaries you can only see what the regime feeds you, but even then I was surprised to see that they weren't like, say, 20 years behind or something like that. It may not be anywhere near as close to the quality in South Korea, but the image of some retrolooking guys from the 1945s is also incorrect. Of course a lot of this is weird, since they perfected the potemkin village strategy where things look so extremely bizarre like from almost 100 years ago now, but then they have some designated people roleplaying as computer designers and architects, and they actually are not totally clueless but know some things (that is, they are not all playing the potemkin part at all times, all the way).
How does one feasibly purchase IP blocks these days? Most blocks that are available are starting in the six figure range, generally higher from what I see.
I am the DevRel for IPinfo. While we recognize that we should have been more accurate in this instance, it’s worth breaking down how our methodology works. We are also rolling out some geolocation tweaks that should neutralize the inaccuracies caused by adversarial correction submissions.
First, we use active measurement for IP geolocation as our primary source. Our main data source is our ProbeNet infrastructure, which consists of 1,200 PoPs across 500 cities. Through ProbeNet, we run active measurements to every IP address and routable IPv6. Because we run both ping and traceroute, we typically have a very strong sense of where an IP address is located.
However, ProbeNet is not our only data pipeline. We process several dozen additional data sources. For example, unrouted or unassigned IP addresses do not generate active measurements, so we must rely on other forms of data.
In reality, we must “fallback” to alternative location evidence when active measurement is unavailable. Even though we manage, expand, and maintain a very large server network and a highly complex data pipeline, some IPs require us to rely on what the ASN operator reports.
It’s fair to say that no ASN other than AS131279 (https://ipinfo.io/AS131279
) is located in North Korea. However, if someone asks for evidence showing that a particular IP address is not located in North Korea, that is extremely difficult to prove in isolation. We prefer not to rely on a null-island methodology and instead choose a location based on a hierarchy of hints.
For unrouted or unassigned IP addresses, geolocation can point to random locations, and in such cases we often must rely on the ASN operator’s data. I’ve seen this happen, even among well-established ASN operators. Some assign random placeholder locations to unrouted and unassigned ranges particularly for IPv6 IP addresses.
20 comments
[ 0.29 ms ] story [ 112 ms ] thread> In reality, the “location” of an IP is inherently fuzzy. For instance, my 2a14:7c0:4d00::/40 block was originally allocated to Israel. But later, I bought parts of this range and announced them via BGP in Germany, the US, and Singapore (see previous article on Anycast networks). Meanwhile, I’m physically located in mainland China. As the owner of this IP block, I can also freely edit the country field in the WHOIS database — and I set it to KP (North Korea).
> Because of this ambiguity, it’s nearly impossible to precisely determine an IP’s location using any single technical method. As a result, almost all geolocation databases accept public/user-submitted correction requests.
I would not be surprised if this practice is technically against most terms of service.
If this was the case, and theres tons of financial incentive to do so, wouldnt cloudflare,etc, block not based on the reported 'country' but some fuzzy heuristic that knows what country it comes from? hops?
also important point when you using Starlink and got totally different "relay" station sometimes can be thousand miles away, I think we need to "upgrade" our internet infrastructure for interplanetary system
ipinfo.io uses a probe network for this[1], but even then a server physically located in the Netherlands with an IP announced as being from, say, Seychelles would still respond to pings faster from a European location than from somewhere like Singapore (unless you go out of your way to induce latency to ICMP responses).
[1] https://ipinfo.io/blog/probe-network-how-we-make-sure-our-da...
However, ideally, we should have a PoP in Seychelles. Some of our recent expansions have been in offshore territories.
https://ipinfo.io/probe-network
Interesting, this really does seem to work on any site behind CF. Are there any other endpoints like this?
But thanks to this series I setup an ARIN account, got allocated ipv6 and ipv4 addresses and starting the ASN assignment process. It’s a fun rabbit hole to go into.
Some background info: in China, all online discourse are required to show the user's provincial-level origin, or country name for non-mainland users, using geoip. this is enforced by the Cyber Admin Commission of CCP.
This is exactly why, unlike much of the industry, we maintain a large team across engineering, data engineering, data science, and research, along with a substantial data-processing infrastructure and 1,200+ servers. Our entire purpose is to verify location data rather than simply aggregate, parse, and repeat whatever is self-reported. Otherwise, it’s just GIGO.
Even though we came up short in this particular case, we are actively pushing updates right now that eliminate these issues going forward.
Previous discussion: https://news.ycombinator.com/item?id=5319419
First, we use active measurement for IP geolocation as our primary source. Our main data source is our ProbeNet infrastructure, which consists of 1,200 PoPs across 500 cities. Through ProbeNet, we run active measurements to every IP address and routable IPv6. Because we run both ping and traceroute, we typically have a very strong sense of where an IP address is located.
However, ProbeNet is not our only data pipeline. We process several dozen additional data sources. For example, unrouted or unassigned IP addresses do not generate active measurements, so we must rely on other forms of data.
In reality, we must “fallback” to alternative location evidence when active measurement is unavailable. Even though we manage, expand, and maintain a very large server network and a highly complex data pipeline, some IPs require us to rely on what the ASN operator reports.
It’s fair to say that no ASN other than AS131279 (https://ipinfo.io/AS131279 ) is located in North Korea. However, if someone asks for evidence showing that a particular IP address is not located in North Korea, that is extremely difficult to prove in isolation. We prefer not to rely on a null-island methodology and instead choose a location based on a hierarchy of hints.
For unrouted or unassigned IP addresses, geolocation can point to random locations, and in such cases we often must rely on the ASN operator’s data. I’ve seen this happen, even among well-established ASN operators. Some assign random placeholder locations to unrouted and unassigned ranges particularly for IPv6 IP addresses.
More context:
https://community.ipinfo.io/t/the-north-korean-gamers-on-ste...
https://community.ipinfo.io/t/why-is-this-orange-com-ip-rang...