IP geolocation works far better on fixed broadband than on mobile networks, and the gap surprises people who test their feature on office wifi and ship it. Understanding why the mobile case is different tells you exactly how much to trust the answer.
Mobile carriers do not hand each handset a public address. They run carrier-grade NAT, pooling thousands of subscribers behind a small block of public IPs anchored to a regional gateway. A phone in a small town may present an address registered to a gateway in the capital, hundreds of kilometres away. The address can also change mid-session when the device moves between gateways or transitions from mobile data to wifi, so any logic that assumes a stable IP for the life of a session will break on mobile first.
Commercial databases publish country-level accuracy in the high 90s, and that number holds up on mobile. City-level is the one that collapses: vendors typically claim something in the region of 50-80% within 50 km for fixed lines, and on mobile ranges the practical figure is meaningfully worse. Treat the output as: country is usually right, region is a coin flip, city is a guess, and latitude/longitude is the centroid of whatever region the vendor could resolve — not the user's position. Several databases return the geographic centre of a country when they know nothing more, which is why a scatter plot of your users sometimes shows a suspicious cluster in an empty field.
MaxMind GeoLite2 is the free option, distributed as .mmdb files you query locally with no network round trip. Registration is required and the database updates twice a week — an out-of-date copy is a common and invisible source of wrong answers, so automate the refresh with the official update tool rather than committing the file. DB-IP and IPinfo publish free "lite" tiers with similar shapes. Paid tiers add connection type, ASN detail and a mobile flag, and that flag is the most useful field in the whole record: it tells you when to distrust the city.
The autonomous system number tells you whether the address belongs to a mobile carrier, a residential ISP, a hosting provider or a VPN operator. For fraud and abuse decisions this is more reliable than coordinates. A request from a hosting provider's ASN claiming to be a residential user in a small town is a signal; a request from a mobile carrier's ASN with a city 200 km away is completely normal.
Behind Cloudflare, a load balancer or any CDN, the socket address is the proxy. Use the platform's trusted header — CF-Connecting-IP on Cloudflare, or the leftmost untrusted entry in X-Forwarded-For — and never trust a client-supplied header without a trusted-proxy list, because it is user-controllable and trivially spoofed. IPv6 adds its own trap: many mobile networks are IPv6-first, and a database keyed only on IPv4 will silently miss those requests.