🔗 TI-2026-023D — The Trust Chain: How 1,357 Geographic Lies Cascade Through Every Database on Earth

Chapter 1: The Five Opinions Problem

Ask any security researcher, compliance officer, or law enforcement agent where an IP address is located, and they'll consult a GeoIP database. They believe they're getting a fact. They're getting an opinion — and depending on which database they ask, they may get a different opinion every time.

Our honeypot threat intelligence platform enriches every attacker IP from multiple independent sources. Each source uses a different methodology to determine geographic location:

Each source has legitimate reasons for its answer. BGP reflects physical routing. RDAP reflects legal ownership. AbuseIPDB reflects the consensus of millions of reports. Shodan reflects what's actually running. IPinfo reflects commercial intelligence.

The problem is not that one source is wrong. The problem is that they're all measuring different things — and every downstream consumer treats them as if they're measuring the same thing.

Chapter 2: The Geography Corridors — Where Countries Move

Discrepancies are not random. They cluster into corridors — repeated patterns where the same type of geographic mismatch appears across dozens of IPs. These corridors tell a story about how infrastructure is actually organized versus how it is presented.

Reading the Corridors

Each corridor has a different meaning:

Chapter 3: The Organizations That Can't Be Pinned Down

Geographic discrepancies concentrate in specific organizations. The top 10 organizations account for over 300 discrepant IPs — and each one tells a story about why geography breaks.

The Anonymous Majority

The #1 organization with geographic discrepancies is RIPE-NCC-HM-MNT — which is not an organization at all. It's the default maintainer RIPE assigns when no specific entity is claimed. Ninety-four IPs with country discrepancies belong to registrations that don't name their operator.

Combined with "Private Customer" (17 IPs) and various other non-descriptive maintainers, over 130 discrepant IPs — nearly 10% of all discrepancies — belong to entities that refuse to identify themselves.

Chapter 4: The Tencent Cloud Case Study — 76 IPs, 12 Countries, One Singapore Rack

AS132203 operates under the name "AceVille Pte Ltd" — a Singapore entity that is, in reality, Tencent Cloud International, the overseas arm of China's internet giant Tencent Holdings (HKEX: 0700, market cap ~$450B).

Tencent Cloud sells virtual servers in 12+ countries. All BGP routing for these servers goes through Singapore. The geographic distribution of our 76 tracked AS132203 IPs:

The "US" servers in Tencent Cloud are interesting. BGP says Singapore. RDAP says United States. IPinfo agrees: United States. The customer buying a "US server" gets a Singapore-routed endpoint with a US IP address — the GeoIP database says "US," every website and compliance system treats it as US traffic, but the actual packets traverse Singapore.

Chapter 5: The Iraq-UAE Corridor — A Case Study in Conflict Zone Geography

Thirty-nine IPs share the same pattern: BGP says UAE, RDAP says Iraq. All belong to Hulum Almustakbal Company for Communication Engineering and Services Ltd (AS203214) — "Hulum" meaning "dream" in Arabic. Their average threat score: 63.8.

This is what happens when a country's internet infrastructure is destroyed by war and rebuilt through neighboring states. Iraq's internet has been rebuilt largely through transit agreements with Turkey, Kuwait, and the UAE. Hulum Almustakbal routes through UAE infrastructure because it's faster, cheaper, and more reliable than Iraqi domestic fiber.

But GeoIP databases don't understand geopolitics. They see UAE routing and assign UAE. The result:

Chapter 6: The Invisible Discrepancy — Why IPinfo Sees Nothing

IPinfo is one of the most respected GeoIP providers. It enriches IP addresses with geolocation, ASN information, and critically — privacy detection flags: VPN, proxy, Tor, relay, and hosting.

We have IPinfo enrichment for 600 of our discrepant IPs — IPs where at least two authoritative sources disagree about the country. The results:

Zero. Not a single discrepant IP is flagged by IPinfo as VPN, proxy, hosting, or any type of privacy service. IPinfo's privacy detection — which compliance systems worldwide rely on — is completely blind to geographic discrepancies.

Chapter 7: The ASN Discrepancy Ranking — Which Networks Lie Most

Some networks produce more geographic discrepancies than others. The top 15 ASNs by discrepancy count:

Three categories emerge:

The critical insight: GeoIP databases treat all three categories identically. They can't distinguish between Microsoft's Azure having a server in a UK datacenter (benign) and M247 manufacturing a "virtual Iran" from Romania (potentially illegal). Both appear as a country discrepancy. Both are reported with the same confidence.

Chapter 8: The Multi-Source Matrix — When Every Database Disagrees

For the most dangerous discrepant IPs (threat score ≥ 85), we can compare five sources simultaneously. The result is a confusion matrix where no two sources fully agree:

The Kosovo Paradox

IP 185.222.138.237 (threat score 97) is classified as Kosovo by three sources — but Kosovo is not universally recognized as a country. Serbia, Russia, China, and 87 other UN member states don't recognize it. RDAP registers it to Albania. BGP routes through Germany. The GeoIP classification as "Kosovo" (XK) is itself a political statement that databases make without acknowledging.

The TERRATRANSIT-MNT maintainer operates in the Kosovo-Albania-Germany triangle — the geographic discrepancy reflects not just technical infrastructure but unresolved geopolitical status encoded into IP geolocation.

The "Private Customer" Pattern

IP 179.61.232.244 (threat score 98) belongs to a "Private Customer" — RDAP reveals nothing about the operator. It's registered to the US, routes through UAE, and has one of the highest threat scores in our database. This is the convergence of anonymity and geographic obfuscation: you can't identify who runs it AND you can't determine where it is.

Chapter 9: The Cascade Effect — From Database to Door-Kick

Geographic trust doesn't stop at databases. It cascades through every system that touches IP addresses:

9.1 Law Enforcement: Wrong Door, Wrong Country

In 2016, MaxMind made a decision that would make national news: for any IP address it couldn't geolocate precisely, it assigned the geographic center of the United States — a farm in Potwin, Kansas, owned by Joyce Taylor. For years, she was visited by FBI agents, IRS investigators, and local police — all looking for scammers, fraudsters, and criminals whose IP addresses MaxMind had assigned to her coordinates.

This was one database, one default value, one farm. Our data shows 1,357 IPs where databases actively disagree. Each one is a potential wrong door, wrong country, wrong investigation.

9.2 Compliance: Sanctions Screens That Don't Screen

OFAC compliance systems — used by banks, payment processors, and trading platforms — use GeoIP to screen transactions. If a transaction appears to come from a sanctioned country, it's blocked. If it appears to come from an unsanctioned country, it's allowed.

Our data shows exactly how this breaks:

9.3 Content Licensing: Geographic Fiction Costs Billions

The global streaming industry licenses content by territory. Netflix pays different rates for content in different countries. When GeoIP says an IP is in the US, the user gets US content and Netflix pays US licensing fees. When that IP is actually in Singapore (Tencent Cloud's "US" servers), the content is being streamed in the wrong territory — a breach of licensing agreements that the streaming service doesn't know about because the GeoIP database told them the user was in the US.

The VPN industry — estimated at $44.6 billion in 2024 and projected to reach $134.35 billion by 2032 (Fortune Business Insights) — is built entirely on the ability to present a different geographic identity to content providers. The GeoIP databases that enable this geographic fiction are simultaneously the databases that content providers rely on to enforce their territorial restrictions.

Chapter 10: The GeoIP Industry — Who Profits From Geographic Fiction

IP geolocation is a multi-billion-dollar industry. The major players:

Notice the "Verification" column. Not a single major GeoIP provider publishes independent accuracy verification. Their accuracy claims are self-reported. MaxMind claims 99.8% country-level accuracy — but our data shows 31.4% of IPs have BGP routing that disagrees with GeoIP classification. These numbers can both be "correct" because they measure different things — but the consumer doesn't know that.

The Feedback Loop

GeoIP databases don't independently verify locations. They copy from each other:

This is why AbuseIPDB agrees 100% with our derived country — it's reading from the same source. When M247 publishes a geofeed saying 62.133.46.0/24 is in Tehran, every database in this chain eventually says "Iran." And when compliance systems check three different databases and they all say "Iran," they treat it as high-confidence — not realizing all three databases trace back to a single, unverified CSV file on a Romanian web server.

Chapter 11: The VPN Review Industry — Conflict of Interest at Scale

If you search "best VPN" on Google, the top results are review sites. Many of these review sites are owned by VPN companies — creating a closed loop of self-promotion:

Chapter 12: The "No-Logs" Lie — Verified Failures

VPN providers market "no-log" policies as their primary trust guarantee. Several have been proven false:

The pattern: every "no-log" VPN provider that has been tested by law enforcement has produced logs. The providers that haven't produced logs haven't been tested — not because they don't have logs, but because no court has ordered them to produce any.

Chapter 13: The Discrepancy Countries — Where Geography Lies Most

Not all countries are equally affected by geographic discrepancies. The countries that appear most often as the "derived" country for discrepant IPs:

The Netherlands, France, and Germany — Europe's three largest hosting markets — produce the most discrepancies. This isn't because these countries are dishonest. It's because they host the most international infrastructure, and GeoIP databases must choose whether a server in Amsterdam owned by a French company serving Brazilian customers is "Dutch," "French," or "Brazilian."

The answer depends on who's asking. GeoIP databases give one answer and pretend it's the only answer.

Chapter 14: The Structural Failure — Why This Can't Be Fixed

The geographic trust chain is broken at a fundamental level. Not because anyone made a mistake, but because IP addresses don't have geography.

An IP address is a number. It's assigned by a registry (IANA → RIR → LIR → operator), routed by BGP, and hosted on hardware in a physical location. But the number itself has no inherent geographic property. All geolocation is inference — and every inference method has failure modes:

Every method can be gamed, every method has legitimate failure cases, and no method can distinguish between a gaming and a failure. This is not a bug. It is the architecture of the internet, which was designed for packet delivery, not geographic accountability.

Chapter 15: Implications for This Investigation Series

This dossier (023D) is part of the VPN Laundromat series that began by asking a simple question: why do our honeypot attackers use VPN services?

The progression is important: what began as an investigation into VPN abuse became an investigation into hosting infrastructure, which became an investigation into geographic fabrication, which became an investigation into the internet's geographic trust model itself.

Each layer revealed a deeper structural problem. The VPN providers aren't the disease — they're a symptom. The hosting companies aren't the disease — they're the infrastructure. The GeoIP databases aren't the disease — they're the transmission vector. The disease is that the internet has no mechanism for geographic truth, and every institution that needs geographic truth — from OFAC to Netflix to the FBI — has built their systems on the assumption that one exists.

Chapter 16: Methodology

Chapter 17: Conclusions

The internet's geographic trust chain is broken — not at one point, but at every point.

"The internet doesn't have a map problem. It has a truth problem — and geography was just the first place where the lie became measurable."

TI-2026-023D · The VPN Laundromat Series · Published June 2026
LSN Threat Intelligence · shuffle-on.com/threat-intel