OSINT Jet · Network evidence

IP Geolocation OSINT: Read the Area, Not Just the Map Pin

Two IP lookup tools place the same address in different cities. Which one should go in your report? Neither city should become a person’s location until you know what the address represents, when it was observed and how uncertain each estimate is.

IP geolocation associates an internet address with an estimated geographic area. It is useful for describing network context and investigating inconsistencies. It does not turn a website’s server, a mail relay or a VPN exit into a person’s street address. This guide gives you a way to compare results without borrowing precision the data never supplied.

First identify the thing you are locating

Ask how the IP entered the case. A DNS answer for a website is a lead about the endpoint serving that name at that time. An address in a mail header can belong to a delivery system. An address in a log you are authorized to examine records an observed connection in that system’s context. These are different starting points.

Keep the exact source field and observation time. “Found an IP in the email” is too vague to review. “Copied the address from this named relay field in the original message” makes the question testable. The email-header guide explains that first layer; the domain guide covers DNS and registration roles.

A content-delivery service may stand in front of a website’s origin. A VPN or shared network may stand between a person and a service. Before discussing cities, put a label beside the address: website endpoint, intermediary, authorized log observation, or role unresolved. If you cannot establish the role, retain that uncertainty.

Collect the result that surrounds the pin

Write down the provider, lookup time, reported country and city, coordinates if shown, and any accuracy radius or confidence information. Also record what the provider does not supply. A missing radius is missing information, not a radius of zero.

MaxMind’s documentation explains that its location estimates are imprecise and that an accuracy radius provides context for the returned coordinates. It cautions against identifying a particular household from those results. Cloudflare describes its own geolocation data as an estimate that changes over time and may disagree with other providers. Those are provider-specific explanations, not a universal confidence scale shared by every tool.

Do not average two coordinates and call the midpoint a better answer. You may be averaging different databases, dates, definitions or network roles. A neat point can conceal a badly formed comparison.

Try this two-provider exercise

Invented example, not live lookup results: use 192.0.2.44 as a label on a training worksheet. It belongs to IANA’s documentation address space; the locations below are made up and should not be queried as a real case.

The circles overlap: the centers are 60 km apart and the radii add to 200 km. Different city labels therefore need not mean that the broad estimates are geographically incompatible. But their overlap is not a newly proven location. The providers may share inputs, and neither circle identifies the company’s workplace.

A defensible note says: “The two providers returned the same country label and different city labels with broad, overlapping stated radii. These results describe the observed endpoint. The business’s physical location remains unresolved.” That sentence preserves both the useful agreement and its limit.

Use a precision budget

Before writing a location claim, ask what level the evidence actually supports: network, country, broad region, city or address. Spend no more precision than you have. Two city names do not earn a street name. Extra decimal places do not earn a smaller uncertainty area.

• Same country, different nearby cities: report the agreement at country level and keep the city estimates separate, provided both observations concern the same endpoint and relevant time.
• Different countries: check the exact address, source role, lookup dates and provider definitions before choosing a result. Until resolved, report the disagreement.
• One tool returns no location: record a missing result. It does not establish that the address has no location or that another tool is correct.
• A pin lands on a house: do not attach the occupant to the case. A displayed center is not a household finding.

Time is part of the location question

Save the observation time and lookup time separately. A current lookup of an address found in a year-old record answers a current database question. It does not automatically reconstruct where that endpoint was when the record was created. If historical data is unavailable, state the gap.

Do not quietly replace the first result when a provider changes it. Keep a dated second observation and describe what changed. The visible result may have changed because the underlying network changed or because the provider revised its estimate; the lookup alone may not distinguish those explanations.

Choose the next check by the decision

If you are verifying a company’s office, an IP map has probably reached its limit. Use the company-address verification workflow and appropriate public business evidence. If you are interpreting the infrastructure behind a website, connect the endpoint observation with the domain record and date. Do not collect someone’s IP through a deceptive tracking link to fill a gap.

For a larger case, OSINT Jet’s relationship-mapping approach helps frame the distinction you need to preserve: an observed network relationship is not automatically a personal or business-location relationship. Supply the public sources and the uncertainty beside each clue, then ask the AI-assisted workflow to organize the case for review. Check current credit requirements before commissioning a report; this basic comparison can be completed without buying one.

A useful final finding lets the reader reproduce the comparison and see where it stops. Keep the address, endpoint role, source, two timestamps, provider outputs, uncertainty information and permitted conclusion together. The most valuable part of the report may be the precise location claim you chose not to make.