Webinar Recording: The World Through 10 IPs: What IP Intelligence Reveals to Investigators

I recently presented a Black Hat webinar called The World Through 10 IP Addresses. The premise was intentionally simple: take ten IP addresses that all geolocate to Seattle and ask a straightforward question:

What can we actually infer from them?

The answer, unsurprisingly, is that "Seattle" is rarely the whole story.

One of the biggest challenges investigators face today is that the internet has become dramatically more complex than the environment many IP intelligence tools were originally designed for. Twenty years ago, an IP address often mapped relatively cleanly to a household or business. 

Today, the same city-level geolocation could represent a residential customer, thousands of mobile users behind carrier-grade NAT, a VPN exit node, an Apple Private Relay user, a satellite connection, a residential proxy, or critical internet infrastructure.

Geolocation remains incredibly valuable. It's almost always useful to know where an IP address is located. But increasingly, it serves as the starting point rather than the final answer.

Ten Seattle IPs, Ten Different Stories

Throughout the webinar, we walked through ten real-world examples that all geolocated to Seattle but represented very different contexts:

• A residential Comcast customer
• A T-Mobile mobile subscriber
• A Starbucks public Wi-Fi hotspot
• A residential proxy endpoint
• An AWS-hosted server
• A commercial VPN exit node
• A Tor relay
• An Apple Private Relay user
• A Starlink satellite connection
• An anycast infrastructure service

Each of these IPs returned the same city-level answer. Yet each carried very different implications for attribution, risk, and investigation.

A residential IP may strongly correlate with an individual household.

A mobile IP likely represents a pool of thousands of devices across an entire metropolitan region.

A public Wi-Fi IP tells you someone was physically present at a location, but not which individual.

A residential proxy may look like an ordinary home broadband customer while actually allowing third parties to route traffic through it.

A VPN, Tor relay, or Apple Private Relay user introduces varying degrees of anonymity and different assumptions about user location.

An anycast IP may not correspond to a single physical machine at all.

Without additional context, all of these environments can look remarkably similar.

The Internet Has Become More Shared

One recurring theme throughout the session was that IP addresses increasingly represent groups of users rather than individuals.

Carrier networks, Apple Private Relay, satellite providers, public Wi-Fi, and various privacy services all rely heavily on shared infrastructure. That means investigators need to think carefully about what an IP can and cannot tell them.

The question is no longer simply: "Where is this IP?"

It's also: "What kind of IP is this, and what assumptions are safe to make?"

This distinction matters for everything from fraud detection and account security to incident response and abuse investigations.

Context Drives Better Decisions

The goal of IP intelligence is not necessarily to block traffic.

It's to provide enough context for teams to make informed decisions.

Knowing that traffic is coming from AWS, for example, may indicate automation, cloud workloads, or infrastructure rather than an individual user.

Knowing that an IP belongs to a Starbucks Wi-Fi network suggests a shared public environment.

Knowing that traffic originates from a residential proxy network may warrant additional scrutiny.

The right action depends entirely on the use case.

The key is having enough information to make that decision intentionally rather than relying on assumptions.

Accuracy Still Matters

Although much of the webinar focused on context beyond geolocation, another important takeaway is that geolocation itself remains foundational.

If your location data is wrong, every downstream decision becomes less reliable.

At IPinfo, we've invested heavily in an evidence-first approach to understanding the internet. ProbeNet, our internet measurement platform, continuously measures network behavior from more than 1,300 points of presence worldwide, allowing us to validate and improve our understanding of how IP addresses are actually being used.

As internet infrastructure becomes more dynamic, independently verified measurements become increasingly important.

Explore our measurements for yourself using ProbeNet Live.

Audience Q&A

We received far more questions than we could answer live, which was fantastic to see. Here are the answers to all of the audience questions. 

IPv6

What data do you provide for IPv6 addresses?

The short answer is: essentially all of our major datasets support both IPv4 and IPv6.

Geolocation, privacy detection, ASN information, and network intelligence are all IP-version agnostic.

In some areas, IPv4 naturally has broader coverage simply because there are more observable signals and much larger deployment footprints today. For example, our Places dataset currently has relatively limited IPv6 coverage because we still observe comparatively few public Wi-Fi networks that are fully IPv6-enabled.

Internally, however, we care about understanding the entire internet, not just IPv4.

We perform extensive work around IPv6 measurement, maintain dual-stack relationships between IPv4 and IPv6 infrastructure, and continue expanding our visibility into how IPv6 networks behave in practice.

As IPv6 adoption continues to grow, having strong intelligence across both protocols will become increasingly important.

Can you correlate IPv4 and IPv6 addresses?

We don't provide a direct one-to-one mapping between an individual's IPv4 and IPv6 addresses.

What you can do is correlate them through shared network context. In practice, investigators often use the fact that both addresses belong to the same organization, ASN, and network ranges to tie observations together.

Internet Infrastructure

How granularly can IPinfo dissect anycast IP information?

We detect anycast empirically rather than taking it from registry data, and every lookup includes an is_anycast flag (documented in our API docs) so you know when a single-location answer can't be trusted.

Our IP look up pages will include more information about how many cities and countries instances we identified for an IP, example: http://ipinfo.io/1.1.1.1 

Can you identify other devices on a subnet?

Not at the device level, and that's by design. Our focus is understanding networks and infrastructure rather than individual devices. What we can tell you is whether neighboring addresses belong to the same network, organization, or environment, which is often useful investigative signal.

Privacy

How do you provide transparency around residential proxy detection?

Our philosophy is that internet intelligence should be grounded in observable evidence rather than opaque assertions. Customers increasingly need to understand why a particular IP has been labeled in a certain way.

For residential proxy detection, we provide additional metadata such as:

• Provider attribution
• Last observed timestamps
• Percentage of days observed

These fields help customers understand whether an IP was seen once, is consistently active, or may have changed behavior over time.

Transparency matters because it allows customers to verify findings, tune their own decision logic, and build trust in the data itself. As an industry, we should continue moving toward more explainable and evidence-backed internet intelligence. Read our deeper walkthrough of resproxy signals in What Makes an IP Look Like It's Part of a Residential Proxy Pool.

Do you collect device telemetry?

Yes, in limited circumstances. Some of our measurements come from our own applications and SDKs, which help improve our understanding of how networks behave in the real world. That telemetry improves data quality, but what we publish remains IP-level network intelligence, not information about individual users.

Investigations and Historical Analysis

Is IPinfo able to call historical IP information by date?

Today, customers can download our datasets and retain their own historical snapshots, and internally we maintain significant historical observations. We also work with some customers who have specific historical requirements. However, we don't currently offer a general product where customers can query an IP address exactly as it appeared at any arbitrary point in time. We make historical data available in our API and datasets with fields like last seen, first seen, last change that are easy to consume and readily available.

From the provider, you pivot to the entry point in the VPN?

Exactly. When an IP resolves as a VPN exit node, our privacy detection names the specific service operating it. For an investigator, that turns a dead end ("it's a VPN") into a next step: you now know which provider operates the infrastructure, and that provider becomes the target of your legal process for entry-point records.

Customer Use Case

Can you comment on how GreyNoise uses IPinfo and the results achieved?

GreyNoise enriches the roughly 12 million IPs their sensor network observes across ~30,000 ASNs with our geolocation, ASN, ranges, and hosted domains data, and derives customer-facing tags from it. In their founder Andrew Morris's words: "IPinfo is absolutely essential to our business. The data is rock solid, the API is dead simple, and the price is unbeatable." Read the full case study.

The Bigger Lesson

The biggest takeaway from this webinar is simple:

An IP address is no longer just a location signal.

It is increasingly a source of rich contextual information about networks, infrastructure, anonymity services, user environments, and internet behavior itself.

Two IPs can share the same city while representing completely different realities.

Investigators, fraud teams, and security practitioners who embrace that richer context will make better decisions, reduce false assumptions, and ultimately gain a much clearer understanding of the internet they're trying to defend.

Because in 2026, asking where an IP is located is still useful.

But asking what kind of IP this actually is is often the much more important question.