How to confirm your real VPN exit country
Address geolocation is a lookup in a commercial database of registrations, so it reports where a block was allocated rather than where the hardware sits. Latency is the check that cannot be faked: a round trip below about 30 milliseconds cannot have crossed an ocean.
4 min read
Providers advertise server locations and geolocation services report them, and the two are not the same claim. A provider may be advertising where a network is registered, where its host says a datacentre is, or where the hardware actually sits. Occasionally those differ, and occasionally they differ deliberately.
Three checks, in ascending order of how hard they are to fool.
Check one: what the databases say
Open what is my IP and read the country. Then check the same address against a second service.
This tells you what websites will conclude, which is often the thing you actually care about — a service applying a regional rule is doing exactly this lookup. It does not tell you where the machine is.
Geolocation works by looking the address up in a commercial database built from registry records, routing data and observation. The registry record says where the block was allocated, which is frequently a corporate headquarters rather than a rack.
Check two: the network it belongs to
Every address belongs to an autonomous system, and the AS has a registered operator. Looking that up says who runs the network rather than where the box is, which is useful in a different way.
whois -h whois.cymru.com " -v 203.0.113.9"
If the operator is a hosting company, that is expected for a VPN server. If it is a residential ISP, something unusual is going on.
Note that the country in an ASN record is where the network was registered. Using it as a location is how every user of a large cloud network ends up placed in whichever country that company incorporated in.
Check three: latency, which physics constrains
This is the one that cannot be faked.
Light in fibre travels roughly 200 kilometres per millisecond, and real paths are not straight, so a practical rule is about 100 kilometres per millisecond of round trip. A server 5,000 km away cannot answer in less than about 50 milliseconds, no matter what any database says.
ping vpn-endpoint.example.net
| Round trip | Maximum plausible distance |
|---|---|
| Under 10 ms | Same city or metro |
| 10 to 30 ms | Same country or nearby |
| 30 to 80 ms | Same continent |
| 80 to 150 ms | One ocean crossing |
| Over 150 ms | Far, or a poor route |
A "Singapore" server answering your London connection in 12 milliseconds is not in Singapore.
The reverse inference is weaker: high latency can mean bad routing rather than distance. Latency proves a server is not far away; it does not prove it is.
Why any of this matters
Legal jurisdiction. Traffic leaving a server is subject to the law where the server physically is, not where the marketing says.
Latency. A virtual location that is physically elsewhere gives you the latency of the real place, which is why a distant server sometimes performs worse than its label suggests.
Regional services. These use the database answer, so for that purpose the database is the truth, whatever the hardware is doing.
Virtual locations, which are not automatically dishonest
Some providers deliberately advertise locations where they run no hardware, routing traffic to a nearby country and announcing addresses registered to the advertised one. It is how coverage gets offered in places where hosting is unreliable or legally awkward.
Done openly and labelled, it is a reasonable engineering decision. Done silently, it misrepresents both the jurisdiction and the latency, and it is the reason the latency check is worth running on any location that matters to you.
VPNmine's server list states what each location is for and what the country's network environment looks like, which is the level of detail that makes the claim checkable rather than decorative.
A two-minute routine
- Load the address page and note the country.
- Ping the endpoint and check the latency is consistent with that country.
- If they disagree, believe the latency.
That is enough for almost every purpose, and it takes less time than reading a provider's location page.
Why databases get it wrong even when nobody is misleading anyone
Geolocation vendors build their datasets from registry allocations, routing announcements, latency measurements and reports from customers. Every one of those inputs has a lag.
A block reassigned from one datacentre to another keeps its old record until someone updates it, which can take months. A network announced from a new location keeps its old classification until the vendor's measurements catch up. Mobile and satellite connections are routinely placed hundreds of kilometres from the user because the block is registered to a national gateway.
The result is that country is usually right and city is often wrong, for every address, not only for VPN servers.
When the country genuinely cannot be determined
Anycast networks announce the same address from many places at once, so there is no single correct answer. Large content networks work this way, and so do some public resolvers. An address like that has no location in any meaningful sense — the machine answering you depends on where you are.
VPN exits are not usually anycast, because a tunnel needs a stable endpoint. If a provider's endpoint does appear to be anycast, the latency check is the only way to know which instance you reached.
