MaxMind GeoIP Databases
What is the site license?
A site license is needed in order to use the GeoIP databases.
Please see our site license page for terms of use of a site license.
How accurate are your GeoIP databases?
Our GeoIP databases are 99.8% accurate on a country level, 90% accurate on a state level, and 83% accurate for the US within a 25 mile radius.
For more details on our city coverage, see GeoIP City Coverage and Accuracy
We arrive at the accuracy figure by checking known IP address and location
pairs against our database.
We obtain the known IP location pairs
from sites that ask the web visitor to provide their geographic location.
The geographic location along with the web visitor's IP Address is forwarded to us.
What about AOL IP Addresses?
We break down AOL addresses on a country level between
United States, Great Britain, France, Germany, Japan, Australia
and Brazil. Some French AOL users appear to come from Great Britain
or Germany due to the way that AOL routes their traffic through proxy servers.
Canadian AOL users will appear to come from the United States.
It is not possible to target AOL users on a state level, due to the
way that AOL routes traffic from multiple states through the same IP address.
How much of the IP Address space do you cover?
We cover all of the IPv4 space, including all publicly available IP addresses.
Will MaxMind support IPv6 Addresses?
Once IPv6 becomes widely deployed, we should have support for resolving
IPv6 IP addresses. In the meanwhile, our C API supports IPv6
lookups using our free GeoLite IPv6 Country
database.
How many IP addresses are in your database? How many countries are included?
Please see our Technical Details page.
What is the difference between the GeoIP ISP and Organization databases?
The ISP database generally contains the ISP, however when
we are not able to obtain the ISP, we include the name
of the organization the IP address block was assigned to.
For example, the ISP database often contains the names of universities,
instead of the universities' ISP.
When only the ISP or organization name is available, both
the GeoIP ISP and Organization databases return the same value.
In this case where the ISP and organization are the same,
the common value usually represents the ISP.
When both the ISP and organization names are available,
the GeoIP ISP and Organization databases return the ISP,
and organization, respectively.
How many lookups can your client APIs support per second for GeoIP Country?
The C Client API can support up to 1,000,000
queries per second on a 1.7 GHz machine when using the memory cached mode.
For more performance details, see our benchmark page.
What are the "A1" Anonymous Proxy entries?
These are IP addresses that belong to anonymous proxy
services such as Anonymizer. These are often used by users to
hide their IP address or to make it appear that they are coming
from a different geographical location.
For more comprehensive proxy checking, see Anonymous
and Open Proxies
What are the "A2" Satellite Provider entries?
These reflect ISPs that offer Internet access to many countries through satellites,
and it is difficult to ascertain the country that the end user originates from. Since we don't
know, it is better to mark them as such, rather than to give false positives. Since
Satellite Providers serve high risk countries such as Nigeria and Ghana,
these IP addresses should be flagged for review.
What are the "EU" Europe and "AP" Asia-Pacific entries?
"EU" and "AP" codes are used in the country code field when there are no
clear indications as to where the end users are located. For example, we may mark a corporate proxy located in London, GB as "EU" if
we can see that the ultimate end users are connecting from various parts of Europe. Marking that IP as coming from London
would not correctly represent where end users are coming from.
Please note "EU" and "AP" codes do not include all IPs covered under those respective regions. Blocking "EU" will only block IPs
with the conditions described above and will not affect all the European countries with specific country codes. To block "EU",
you need to list the specific countries individually.
How do you keep the database size so small?
We store the IP address -> country associations by Network block,
which allows us compress the data a lot without losing any data.
So for example, if we know that 3.0.0.0/8 is all in one country,
then we can just store that, instead of storing each IP address
in that network block. The net result is much faster and takes up much less space.
GeoIP Upgrades/Updates
Can I upgrade from GeoIP Region to GeoIP City?
Yes you can upgrade for the difference in cost ($220) within one month of a GeoIP Region purchase
or update. After one month the upgrade price is $256.
For more details, see our purchasing page.
How often is the database updated?
GeoIP Country and the binary formats of GeoIP Region and City are updated weekly. All other databases are updated monthly. About 1-2% of the GeoIP database changes each month.
Are updates provided as self-contained databases or do you just
provide the updated differences?
Each update is provided as a self-contained full database.
How often do I have to purchase updates?
You can purchase updates how ever often you like, for the same update price. For example,
you could purchase an update for the GeoIP City database for $90 every three months, and only have to pay
the $90 every three months instead of every month. This is available by clicking "Add one-time update" on
your account page.
How are updates provided? Can I automate updates?
Updates are provided electronically and can be downloaded from within your account page.
We offer automated updates for the GeoIP
databases in binary format, using our geoipupdate program.
The geoipupdate program works best on Unix or Linux, however, we do have a
HTTP interface for downloading the GeoIP databases.
I updated my database, but my application is still returning old GeoIP data.
Do I have to restart my web server when I update the database?
The GEOIP_CHECK_CACHE flag in the C, Java and Perl APIs and the CheckCache flag in the mod_geoip module
makes the API check for updated database for each GeoIP call. If the database has been updated, the
API then reloads the filehandle and/or the memory cache. If you are using PHP
in GEOIP_STANDARD mode, typically the GeoIP object
is instantiated on each call, so there is no need to restart the web server.
Using GEOIP_CHECK_CACHE does negatively impact performance (API benchmarks).
For Apache applications that require high performance, an alternative is to
send a USR1 signal to restart Apache, without interrupting the service when the database is updated.
To send a USR1 signal, use:
apachectl graceful
or
kill -USR1 `cat /usr/local/apache2/logs/httpd.pid`
GeoIP Implementation
How can I block access from specific countries to my website?
If you are using the Apache web server, you can block access for your
entire website from
specified
countries by
using our mod_geoip API.
For other web servers, you can block access to dynamically scripted pages
by using any one of our APIs.
You would need to
create a script on your website to determine the country of the
IP address by calling the GeoIP Country database with one of our
APIs, then have the script only display content based on the
country returned by GeoIP.
Another option is to block traffic on a firewall level before it
reaches your web server. iptables/netfilter's geoip match
incorporates GeoIP into Linux's firewall software.
How can I redirect traffic to my website to location-specific pages?
How will this influence search engine rankings?
If you are using the Apache web server, you can redirect traffic based on the
visitor's country, region or city by
using our mod_geoip API.
More generally, you can redirect dynamically scripted pages
by using any one of our APIs.
You would need to
create a script on your website to determine the location of the
IP address by calling the GeoIP database with one of our
APIs, then have your script redirect to another URL based on the
location returned by GeoIP.
Many search engine spiders originate from the United States, so
they will see your website as presented to US visitors. To
have the search engine spiders index the entire site, you
may want to include links to your other country specific
pages on your website.
How do I determine the IP address behind a proxy?
Transparent proxy servers send HTTP headers including
X-Forwarded-For and Client-IP.
Note that not all proxy servers use these headers.
Where can I get a conversion table of region codes to names?
We maintain a lookup table of region codes to names for
US and Canada
and
all other countries
Our lastest C, C#, Java, PHP, Python,
and Perl APIs have built-in support for region name lookups as well.
I would like to plot the Geographical locations of my visitors on a world map. How can I do this?
There is an open source Perl module, Image::WorldMap,
that creates graphical world maps of longitude/latitude data.
How can I determine the timezone of a website visitor?
It is possible to get the actual timezone of the website visitor's computer
by using JavaScript. A Google search
reveals some useful code samples of how to determine the timezone using Javascript.
Alternatively, you can use the output of the GeoIP database to estimate the
timezone of the user. We provide a text file as well as PHP code for mapping countries, US states, and
Canadian provinces to timezones in zoneinfo format (e.g. America/New_York).
Our C, Java, PHP, Python and Perl
APIs have built-in support for timezone lookups as well.
How can I determine the preferred language of the website visitor?
The easiest, recommended way is to use the Accept-Language HTTP header
to get the user's language preferences. Alternatively, you can use GeoIP Country to first determine the country, then select the
language based on the country returned by GeoIP.
When do you recommend using the Memory Caching mode, GEOIP_MEMORY_CACHE?
Where memory usage (on the order of 1MB for GeoIP Country) is not important, and when there are repeated queries
using the same object. The standard mode (GEOIP_STANDARD) can support 400,000 queries per second using the C API,
so for many purposes it is fast enough.
How can I find the Postal Code of an IP address?
About 56% of GeoIP City records in the United
States have postal codes.
In many cases we are able to identify the
city, but the city has multiple postal codes,
so we don't identify the postal code in that
case unless we are confident that the IP
address is likely to be in that postal code and not one
of the others in the city.
Not being able to determine the postal code in many
cases is a general limitation of geolocation services.
Typically an ISP will have its users connect to a central
office and assign their client an IP address from a block
of IP address. The block of IP addresses will be given
out to clients spanning several zip codes. For instance,
if you connect to a dial-up ISP in New York City, your
provider will typically have a 212 access number number that is used
from any postal code in the city.
With a postal code database such as iBegin.com's free US Zip Codes
you could lookup a US postal code using the city and state returned by the GeoIP City database. Alternatively
you can use the GEO-132 Binary Format (without metro/area codes) GeoIP City, which contains postal codes for every US city-level resolution,
even when we aren't confident in the accuracy of the postal code. For the CSV format, we
have a location file with postal
codes for every US city record.
Worldwide postal code databases can be found Event Me's
free postal code sources and downloads, as well as our own Canada, Germany, Great Britain and Mexico Postal Code databases.
How can I find nearby postal codes?
There are open source postal code distance calculators that can find
postal codes within x miles of another postal code. Geo::PostalCode is a Perl module available on CPAN,
and Zipdy is available in C, PHP and Perl.
GeoIP Troubleshooting
I'm using one of the GeoIP APIs and having trouble getting it installed or working properly.
Please refer to the README or INSTALL file included in the API download.
I uploaded the GeoIP binary format file to my server using FTP. The file seems corrupted and none of the queries work.
You may have used ASCII mode when uploading the GeoIP file with your FTP client. Be sure to check the "binary" mode when using your
FTP client to upload GeoIP binary format files.
I loaded the GeoIP CSV file into my database, but some IP addresses are missing.
The most likely issue is that the database columns for the beginIPNum and endIPNum are not large enough.
If IP addresses towards the beginning of the allocation space (e.g. 4.4.0.0) are present in the
database, but IP addresses between 128.0.0.0 and 225.255.255.255 are missing, then either the database columns are not
large enough or the file somehow got truncated before or during the database import.
To make sure the database columns are large enough, be sure to use UNSIGNED INT in your database table
definition for the startIPNum and endIPNum columns.
MaxMind Web Services
Do I get a warning if I am running out of queries?
A warning email will be sent out when the number of queries for the GeoIP Country
or City web services falls
below 10,000.
Should I choose the web service or the database?
It depends on your needs and there are three main considerations.
1. Whose infrastructure do you want to depend on?
Our web service has had very good uptime - 99.97% since October of 2002
- and responds quickly, but with a local copy of the database you are
not dependent on the availability of our servers and can also perform
many more queries per second. These lead people to choose the database.
2. Do you want to perform your own maintenance?
Most companies update the database to stay current with the IP
allocations. With the web service, MaxMind maintains the database on its
servers and you only need to point our API at them. This leads people to
choose the web service.
3. Is cost a consideration?
There is also a cost difference. Once a license/update is purchased, the
database can be queried without limit, but with the web service, each
time you ask our servers to respond with the location of an IP address,
we deduct one query from your account. If you divide the cost of an
update by the number of queries you are doing, below a certain number of
queries per month, the web service is less expensive and above a certain
number of queries per month, the database is less expensive.
GeoIP License
I would like to use GeoIP on xyz.com, xyz.ca, xyz.biz. Do I need more than one site license?
As long as you own, operate, and have sole access to those websites, you only need one site license.
We are a hosting provider and have a license to one of your GeoIP databases, can we
install it on the different servers that we provide to our hosting clients?
No, while you can install the databases on multiple servers, it can only be for internal use.
Any company that has access to the data/databases must have their own license.
I would like to use the GeoIP data to power a web log/analytics tool that
I provide to my clients. Is this allowed with just one site license?
Only one site license is needed if the GeoIP data resides on your servers, and
one of the following two conditions are met:
1) The client must not have any direct or indirect access to the data. For example,
the IP addresses of the client's visitors should be captured through something like
Javascript. If the IPs are obtained via log files, the clients must not have the
ability to modify the log files.
OR
2) GeoIP data is provided in aggregate, where
the IP address is not presented with the associated GeoIP data. Please see the
sample log report examples below:
a) 3 visits from 24.24.24.24 Ithaca, New York, US (Not allowed, unless condition 1 is meet.)
2 visits from 24.24.23.23 Chitengo, New York, US (Not allowed, unless condition 1 is meet.)
b) 3 visits from Ithaca, New York, US (Allowed)
2 visits from Chitengo, New York, US (Allowed)
I would like to setup a website where my clients can enter a IP address
and get the GeoIP information back. From reading the license agreement, it
seems that this would not be allowed. However, I have seen other sites do this. How can I do this too?
No. You may not use the GeoIP database in this manner because it would give your visitors direct
access to the data. You can use something like Javascript to automatically capture the visitor's IP and present
them with GeoIP data for their IP address but a free lookup tool is not allowed. However, you can use the
GeoIP Web Service to offer the free lookup. We recommend you implement some type of query control
(e.g. number of queries per IP per day) as automated spiders can quickly deplete your account.
MaxMind minFraud Service
How effective is MaxMind in preventing different types of chargebacks?
MaxMind's minFraud service is effective in flagging online purchases
made with stolen card numbers.
MaxMind's service does not protect against
"friendly" chargebacks where the cardholder placed the order, but later denies having
placed the order and issues a chargeback. To help prevent "friendly"
chargebacks, have the customer
fill out a fax authorization with signature
form.
What happens when I use up all of the queries allowed under my subscription plan?
You will continue up to receive 500 free queries/day of the Basic minFraud service
to allow time to upgrade to a higher volume plan. You can
email support@maxmind.com to request that more queries be added to your plan.
Can I customize the formula used to generate the fraud score returned by the minFraud service?
You can write your own code to customize the fraud scoring
algorithm, since MaxMind returns the inputs into the formula used to
calculate
the fraud score.
To customize how the fraud score is calculated,
modify the formula we use to calculate the
fraud score, using the output results returned by the minFraud service
as inputs into your modified formula.
What does the proxy score tell me?
The proxy score is another metric for determining the likelihood that
a transaction is fraudulent.
See our statistical analysis of proxy scores from transaction and chargeback
logs.
Can I mix the standard and premium queries in a single account?
You can mix standard and premium minFraud queries if you subscribe
to both services.
To specify whether you would like to call the
standard or premium service, use the requested_type
input parameter.
What is the difference between the standard and premium minFraud? Which one should I use?
The services are similar, the only difference being that the premium outputs the credit card's
issuing bank's country, name and phone number. If you typically call the bank to manually
verify the cardholder's details, then the premium
service would provide the phone number of the bank.
On the other hand, if you don't need to call the bank, or if the transactions are
automatically screened and processed, the standard service should be sufficient.
For more details, see our minFraud Feature Comparison page.
What kind of coverage does minFraud have? Can it screen international orders?
The minFraud service can be used to screen orders for any merchant and from any customer from around the world. This
is because minFraud is a 3rd party IP address centric fraud detection service and not dependent on the infrastructure
of the payment industry. As a result, it is not affected by the typical geographical limitations that affect
checks such as AVS, 3D-secure, or other authentication tools.
I run multiple sites. Can make API calls to the same minFraud account from the different sites?
Yes, you can use the same minFraud account to screen orders from multiple sites.
What is a minFraud Alert? What should I do with it?
The minFraud Alerts are generated as part of our post-query analysis
feature. minFraud Alerts are manually reviewed before they are sent out.
After the initial scoring, we store each transaction and continue to
monitor and analyze the transaction for another 2-4 weeks. We
cross-reference and cross-check the transaction more rigorously against
new and historic data sets and other fraud related data derived from the
overall minFraud system. If the post-query analysis system uncovers any
suspicious transactions that were not flagged initially, the
transactions are reviewed manually and minFraud Alerts are sent out if
appropriate.
We recommend that all orders that were flagged by minFraud Alerts be flagged and shipment delayed. For digital goods, the associated
accounts should be frozen or closed to mitigate further losses.
I haven't received any minFraud Alerts. Is something wrong?
minFraud Alerts are only generated for high risk transactions that were not flagged by the system during the initial query.
As a result, not every client will receive them. The frequency of minFraud Alerts has a lot to do with the kind of fraudsters
that a site attracts. In general, minFraud Alerts flag transactions from more sophisticated fraudsters who are good at simulating
legitimate transactions.
Alternatively, be sure to be able to receive (or whitelist) e-mails from support@maxmind.com. minFraud Alert e-mails
are sent from the e-mail address to the e-mail listed as the technical contact. If you prefer to not receive the alerts via e-mail, you can have them automatically
posted to a URL of your choice: Setup minFraud Alert URL (login required).
Is the minFraud service PCI compliant?
Since the minFraud service does not receive any personal data such as the complete 16-digit credit card number, the complete
billing address, or social security number, we were told by Visa that it was unnecessary to be PCI compliant.
While we are not bound by PCI regulations, we still take data security very seriously.
Can the subscription be changed in case we need to increase the amount of queries at a later date?
Yes. To upgrade to a new subscription plan, please e-mail support@maxmind.com and say which subscription level you would like to
upgrade/downgrade to.
Do unused queries carry over or do they expire at the end of the monthly cycle?
It depends on what kind of plan you are currently using. Under the subscription plan, unused queries expire at the end
monthly cycle. If you purchased the service under an one-time bulk purchase or the customized auto-renewal plan, the queries
do not expire at the end of the monthly cycle.
|
