Why Mobile Roaming Breaks IP Geolocation and How Prefix Classification Can Fix It

Shivani was a 2025 IPinfo research intern. To apply for 2026, contact the research team.

In July 2025, the IP prefix 139.28.84.0/24 geolocated to France. A few weeks later, the same prefix resolved to the United Kingdom. The prefix is registered to Telecom North America. None of these locations were necessarily wrong, this is what happens when roaming traffic meets static geolocation. To understand how often this happens and why, we set out to classify mobile carrier IP prefixes globally, distinguishing between roaming types, operator architectures, and eSIM behavior.

This classification is harder than it sounds. Roaming IPs can appear domestic, hiding a user's true location. Prefixes may be shared across carriers or reused in different regions. Carrier-Grade NAT (CGNAT) masks individual users behind shared public IPs, and eSIM users may route traffic through VPNs or tunneling infrastructure. All of these factors make accurate prefix attribution a prerequisite for reliable mobile geolocation.

How We Collected the Data

IPinfo has a free mobile app (iOS | Android) that shows real-time IP, geolocation, and network details for every connection on your device. In August 2025, we added roaming and eSIM tags to the app, giving us ground-truth signals for whether an IP is associated with roaming traffic, a physical SIM, or an eSIM. We supplemented this first-party data with one month of global cellular observations from radio-monitoring applications with broad geographic and network coverage, analyzing IP prefixes.

For a one-month period, IP prefixes were analyzed for both IPv4 and IPv6 addresses, categorized as roaming, non-roaming, and those common to both roaming and non-roaming traffic.

The vast majority of prefixes appear only in non-roaming traffic. But the 258 roaming-only IPv4 prefixes, while a small fraction of the total, are disproportionately likely to cause geolocation errors, since their traffic originates from locations that don't match the prefix registration. The 1,480 "common" prefixes that appear in both roaming and non-roaming traffic are also significant: these are the prefixes where home-routing is most likely in play.

Roaming Architectures

Mobile Network Operators (MNOs) rely on the IP Packet Exchange (IPX) network to provide roaming services. The IPX network is operated by a small number of IPX Providers (IPX-Ps) that peer with each other over a private, tightly meshed backbone isolated from the public internet. By partnering with a single IPX-P, an MNO can extend its roaming services globally, while the IPX-P enforces policies defined by roaming agreements.

• Home-Routed (HR): The home network assigns the IP address to the roaming user. This allows access to home-network services, but all traffic is tunneled back to the home network, which increases latency.
• Local Breakout (LBO): The visited network assigns the IP address to the roaming user. Traffic goes directly to the internet from the visited network, resulting in lower latency, but access to home-network services is limited.
• IPX Hub Breakout (IHBO): A third-party IPX provider assigns the IP address. Traffic is routed to a nearby gateway selected based on location, latency, and roaming agreements, balancing performance and service access.

These architectures have fundamentally different geolocation implications. Home-routed traffic geolocates to the home country regardless of where the user actually is: a German tourist in Spain still gets a German exit public IP. Local breakout geolocates correctly to the visited country but loses its association with the home sim operator. IPX hub breakout lands somewhere in between, geolocating to wherever the IPX provider's nearest gateway sits. Knowing which architecture is in play determines whether a prefix's geolocation is trustworthy or misleading.

Using signals from our mobile app and cellular observation data, we identified 303 IPv4 and 47 IPv6 prefixes that are likely home-routed.

Distribution of IPv4 addresses and IPv6 addresses that are likely home-routed are as follows:

Nearly half (48.5%) of likely home-routed IPv4 prefixes are /24s, the smallest commonly routed block. This concentration suggests these are narrowly allocated pools tied to specific operator assignments rather than large aggregated ranges, which is consistent with home-routing behavior where the home network assigns addresses from its own address space. On the IPv6 side, /48s dominate at 46.8%, following the standard allocation pattern for end-site assignments.

We also identified operators that operate in multiple countries, with many such cases occurring near national borders when users cross between countries. Understanding the geolocation implications of these scenarios is crucial. In total for one month of data, 193 carrier or network operators were observed operating in more than one country.

For example, Vodafone D2 GmbH, whose home country is Germany, operates across 10 countries, including Austria, the Netherlands, Belgium, France, Switzerland, Czechia, Poland, Luxembourg, Denmark, and Liechtenstein, with observed latitude and longitude points primarily clustered near Germany’s border regions.

Another example is Digicel (Jamaica) Limited, a Jamaican carrier operator, which appears not only in Jamaica but also in eight other countries: Barbados, Dominica, Grenada, Cayman Islands, Saint Lucia, Montserrat, and Saint Vincent and the Grenadines.

Roaming-only prefixes are where geolocation breaks down most visibly. Take 139.28.84.0/24: it's registered to Telecom North America, but appeared in traffic from multiple countries. Traceroute-based geolocation placed it in France during July–August, and it currently resolves to the United Kingdom. Without a roaming flag, any system consuming this data would confidently assign a wrong location. Marking such prefixes explicitly as roaming and mobile allows downstream systems to treat their geolocation as unreliable rather than authoritative.

Domestic roaming can also occur within a country. For example, in India, this is common due to the telecom circle structure, where the country is divided into multiple circles based on states or regions. Mobile operators may hold different Mobile Network Codes (MNCs) in different circles, so when a user moves between circles, their device may effectively roam onto another network of the same operator, resulting in domestic roaming behavior even though the user remains within India.

What This Means for IPinfo's Data

This research directly informs how IPinfo handles mobile prefixes in its carrier and geolocation datasets. By identifying which prefixes are roaming-only, which operators span multiple countries, and which roaming architecture is likely in use, we can flag these prefixes so downstream systems don't treat their geolocation as a reliable location signal. Instead of returning a single confident (but wrong) location, systems consuming this data can surface the uncertainty or fall back to other indicators.

What's Next

Mobile roaming makes IP geolocation unreliable, but it doesn't have to make it wrong. By classifying prefixes as roaming-aware and understanding which architecture is in play, systems can avoid the worst geolocation errors and make better decisions about when to trust an IP's location signal.

Next, we'll be exploring multi-country operator patterns in greater depth and deploying active latency measurements to map the routing behavior behind these prefixes more precisely.