This is where the address is registered, not where the device is. IP geolocation resolves a netblock to whatever the registry, the carrier and the inference vendor believe about it. For a small utility behind a carrier it commonly returns the carrier's registered city — often a different state from the equipment. The same root cause put a 2.7% attribution ceiling on Tool 57.
Country is usually right. City frequently is not. Country-level accuracy is high; city-level is far weaker and collapses entirely on mobile carriers, CGNAT, satellite and anything behind a VPN or proxy. The circle drawn around each pin is the provider's own stated accuracy radius — when it is large, the pin means almost nothing, and the map shows that rather than hiding it behind a confident dot.
One limit on that flag: some providers use the capital city as their country default. A placeholder on central London, Beijing, Tokyo, Singapore or Frankfurt cannot be told apart from a genuine hit in that city by coordinates alone, so those are deliberately not flagged — a warning that fires on real results would teach you to ignore it. If a data set lands implausibly hard on one capital, treat it with the same suspicion the flag would give you.
Watch for DEFAULT CENTROID. When a provider cannot place an address it returns the country or region centre rather than saying so — and those coordinates are real addresses belonging to real people. The best known is a farm in Kansas that sat at the centre of the United States in one provider's data; its residents were harassed for years by people who believed they had located someone. Any result carrying that flag is a placeholder, not a place, and must never be treated as pointing at anyone.
For attribution work, the coordinates are the weakest field in the response. An address geolocates to the provider the operator rented from, not to the operator. What narrows infrastructure attribution is the ASN and netblock owner, RDAP registrant, passive DNS, certificate reuse across hosts and reverse DNS patterns. Use the map to scope — which jurisdictions, which providers, how concentrated — not to identify.
The infrastructure column has one fact and two inferences. TOR EXIT is membership of the Tor Project’s own published exit list — verifiable, and you can cite it. HOSTING and VPN are read from the network operator’s name: a home user is not on AWS, so an address there is rented infrastructure rather than somebody’s house. Good signal, not proof — plenty of organisations route corporate egress through hosting. And an empty column proves nothing. Residential proxy networks relay through real home broadband on ordinary consumer ASNs; they are invisible to every check in this tool. “No match” means nothing matched, not that you are looking at somebody’s living room.
The reachability symbol is a web probe, not a ping. A browser has no ICMP and no raw sockets, so the only test available is an HTTP request to port 443. ✕ NO ANSWER does not mean the host is down — most infrastructure runs no web service, plenty of hosts drop unsolicited traffic, and a firewall in between produces exactly the same silence as an unplugged machine. Treat ● and ◐ as evidence of life; treat ✕ as no information. And note that probing is active: it opens a connection from your network to the host, and appears in their logs as coming from you. Nothing is probed unless you press the button.
RPKI answers whether the origin is authorised. The prefix holder can publish a signed statement naming which AS may announce their space. VALID means the announcement matches it. INVALID means the AS you just narrowed to has no right to announce this prefix — a misconfiguration or a hijack, and the origin may not be the party that holds the space at all. NO ROA is the ordinary case: most of the internet has never published one, so it is an absence of data rather than a finding, and it is deliberately not styled as a warning. Announcement age is context in the same spirit — space that appeared weeks before an incident is worth a second look, and is not on its own evidence of anything.
Never treat a pin as an address. It is not evidence of who or what is at a location, and it will not survive scrutiny as one. Use it to see the shape of a data set — which countries, which providers, how concentrated — and confirm anything that matters through registration data and the party that operates the netblock.