Download Geolocation Database

Introduction

Geolocation is the process of mapping IP addresses to a geographical location defined by latitude and
longitude. There are many use-cases for geolocation intelligence that are demanded by online businesses and
service
providers:

• Targeted Advertising – Allows advertisers to serve ads that are geographically relevant
  to users. By knowing the approximate location of an IP address, advertisers can deliver targeted
  advertisements based on the user’s location, such as promoting local events, services, or products.
• Fraud Detection and Prevention – By knowing the geolocation of an IP address, unusual
  login attempts or unusual financial transactions can be detected and blocked. For example, if a banking
  account is normally used by a IP address from country A and there is suddenly a login attempt from country
  B, the login attempt can be denied or the user can be asked for additional verification.
• Content Localization – Websites and apps often want to deliver localized content to
  users. Based on the user’s location, websites can provide region-specific information, language
  preferences, or display prices in the local currency.
• Digital Rights Management and Compliance – Content providers use IP geolocation
  intelligence to
  enforce digital
  rights management (DRM) policies and regulations or restrictions. Those providers may restrict access to
  content based on the user’s
  geographic
  location, ensuring compliance with licensing agreements and copyright restrictions.
• Network Security – IP geolocation plays a role in network security by providing
  insights into the origin of potential threats. Security systems can use IP geolocation data to identify
  and block suspicious IP addresses or implement access controls based on geographic regions.
• Analytics and Insights – IP geolocation data can be valuable
  for analyzing user
  behavior and trends. Businesses can gain insights into where their customers are located, which can inform
  marketing strategies, expansion plans, and product development.

IP Geolocation Accuracy

Why is IP geolocation sometimes not accurate in general?

In some cases, allocated IPv4 and
IPv6 networks are distributed geographically and thus one network can have multiple geographical
locations. Furthermore, many networks are distributed geographically by design. Examples of such
geographically disparate networks are mobile networks or
satellite networks.

For example, how exactly would you geolocate the IP ranges belonging to the satellite Internet from
Starklink from SpaceX? Find out by yourself by inspecting
Starlink’s AS14593.

In other cases, IP networks are reassigned or reallocated by Regional Internet Registries or IP leasing
companies
(such as IPXO or ipbroker.com) and the
geolocation
completely
changes as soon as a IP address is assigned a new owner.

It turns out that the process of geolocating IP addresses is a complicated endeavour. However, the accuracy
that
can be obtained is too good to
be ignored in any IP address API.

How to build a IP Geolocation Database from
Scratch?

The reminder of this page makes a deep dive into the technicalities of creating a geolocation database from
scratch. If
you are only
interested in downloading the geolocation database, you can do so here.

Each IP address in the Internet is owned or administered by an organization. Regional Internet Registries
(RIR’s) such as ARIN or APNIC store
ownership information in their WHOIS databases.

However, WHOIS records don’t
necessarily include geolocation information for allocated networks. Furthermore, organizations that
own networks can use those networks in any geographical location they end up choosing. Even worse, those
organizations can assign networks to any third-party organization or lease IP blocks to other
entities. Therefore, it is inherently tricky to geolocate IP addresses and thus geolocation is often not
accurate.

Having said that, the task to find and collect geolocation information can be divided into three
different
sub-tasks:

1. Extract Geolocation Data from WHOIS Records Directly – WHOIS records often include
   direct
   geolocation information about IP addresses. WHOIS attributes such as geoloc and
   geofeed can be used to derive self-published geolocation knowledge about IP addresses.
2. Interpolate Geolocation Knowledge from WHOIS Records – Often it is
   possible to derive and interpolate geolocation information from WHOIS attributes indirectly. For example,
   organizations
   that are administratively responsible for a network have to provide their postal address in
   WHOIS
   records.
   Sometimes, this postal address is also the geographical location of the organization’s networks.
3. Consider Open Source Geolocation Projects – Many entities invested considerable
   resources into the geolocation problem and they provide their geolocation information for free. RIPE IPmap, geofeed-finder and OpenGeoFeed are good examples of such valuable
   open source projects.

After compiling a raw geolocation database from the above sources, it may have incomplete or inconsistent
records.

The collected geolocation data may be incomplete since records with country and city information don’t
always
include coordinates. Vice versa, sometimes raw records with coordinates don’t have country and city
information.
If raw
records only contain a
country,
the
accuracy cannot be higher than on country level.

Therefore, geolocation
data needs to be enriched and transformed into a
common format. This process is extremely important and is achieved by using open source geographical
databases
such as the ones from geonames.org or openstreetmap.org.

Put differently, the data enrichment task is to either:

1. Find the latitude and longitude from a given city and country pair. Example: What are the
   coordinates for US, San Francisco?
2. And on the other hand, if only the latitude and longitude is given, the task is to obtain the closest
   city for those coordinates. Example: What is the city and country
   for the coordinates 52.524526 13.410037?

The next sections describe all the major steps that need to be followed in order to build a geolocation
database
from scratch.

Extract Geolocation Data from WHOIS Records
Directly

This section describes how the different WHOIS databases from the five major Regional Internet
Registries
(RIR’s)
provide direct geolocation support for IP networks in their WHOIS records.

By analyzing and parsing WHOIS data from all five Regional Internet Registries, many IP
addresses can be mapped to a geographical location. Since each RIR has their own WHOIS database format,
each RIR
needs to be treated distinctively. In the next sections, it will be discussed how geolocation
information is provided in each of the five different WHOIS databases.

Geolocation in RIPE NCC

The RIPE NCC database has two different attributes that provide geolocation information for
inetnum and inet6num objects. The inetnum and inet6num
objects assign an IP network to an organization. It is suggested to read the RIPE
documentation about inetnum
and inet6num
objects.

As mentioned, there are two different attributes in inetnum and inet6num
objects that allow to provide geolocation information to IP networks:

1. The geoloc attribute
2. The geofeed attribute

The geoloc attribute

The first attribute is the geoloc
attribute. The geoloc attribute simply contains latitude and longitude
coordinates
in string format (Example: "47.855374 12.132041").

The geoloc attribute is defined in the RIPE
Database
Docs as follows:

“geoloc:” – The geolocation coordinates for the resource in decimal degrees notation.
Format is latitude
followed by longitude, separated by a space. Latitude ranges from [-90,+90] and longitude from [-180,+180].
All more specific objects to the inetnum object containing this attribute inherit this data.

For example, the inetnum object for the IP address 217.72.221.0 includes the
geoloc attribute. The WHOIS
record below can be obtained via any whois client with the terminal command
whois 217.72.221.0:

inetnum:        217.72.221.0 - 217.72.221.255
netname:        KOMRO
descr:          komro GmbH
country:        DE
admin-c:        KIN65-RIPE
tech-c:         KIN65-RIPE
status:         ASSIGNED PA
mnt-by:         KOMRO-MNT
mnt-lower:      KOMRO-MNT
mnt-routes:     KOMRO-MNT
created:        2003-08-29T12:22:59Z
last-modified:  2017-07-31T05:45:34Z
source:         RIPE # Filtered
geoloc:         47.855374 12.132041
language:       DE

So what does the above WHOIS record reveal? The responsible organization of the network
217.72.221.0 - 217.72.221.255 is komro GmbH and the geoloc attribute claims that
the network
is located at the
coordinates
47.855374 12.132041. Those coordinates point to Rosenheim,
a city close to Munich in Germany.

What is the total coverage of the geoloc attribute for all inetnum and
inet6num objects in the RIPE NCC database?

At the time of writing in July 2023, there were 4,190,644
inetnum and 819,381 inet6num objects in the RIPE NCC database. But only 114,389
inetnum or inet6num objects contained the geoloc attribute.

Therefore, the
overall coverage of the geoloc attribute is only 2.3%.
However, more and more organizations start using the geoloc attribute, therefore it is useful
to start collecting it.

The geofeed attribute

Another method to provide geolocation information in the RIPE NCC database is the geofeed attribute.

The geofeed attribute is defined in the RIPE
Database
Docs as follows:

“geofeed:” – Contains a URL referencing a CSV file containing geolocation data for the
resource. The geofeed
format is defined in RFC
8805.

The value of the geofeed attribute is a HTTPS url that points to a file that contains
geolocation
information. The format of such geofeed files is specified in RFC
8805. Currently, there are two different ways to provide such a geofe