Geofeed

Each line holds a block, a country code, a region and a city, separated by commas. The standard's own example is the IETF's meeting network. The same block, 130.129.0.0/16, moves to a new city for every meeting, and its geofeed is updated each time. For the November 2019 meeting it read "130.129.0.0/16,SG,SG-01,Singapore,".

That is where the idea came from. The standard notes that networks which "move from one conference location to the next" had already published small feeds of their own.

A feed counts when the registry record of the block points to it. The RIPE Database added a geofeed: attribute to address records, following an impact analysis in November 2021, and APNIC lets holders link a feed through MyAPNIC. A standard of August 2024, RFC 9632, describes the link and an optional RPKI signature that proves the file comes from the block's holder. A signed feed must be preferred over an unsigned one.

Neither registry checks the content. RIPE's database team wrote that the feed's address "will not be checked" for reachability and that "the content of the URL will not be validated". The registries make sure only the holder can attach a feed. They do not make sure the feed is true.

Location data companies build them into their databases. MaxMind runs a programme in which network operators get reports on how their networks are coded, with a report per geofeed. Google publishes a feed of its own for its public DNS addresses.

The standard asks readers to check that a publisher is authoritative for the addresses in its feed. Without that check, it notes, "ISP Bob" could make location statements "about IP space held by ISP Alice".

In March 2024 the security firm DCSO described networks publishing forged geofeeds, "presumably with the objective of circumventing access control measures (such as country-level geoblocking)". In its example, a block registered in France was declared by its feed to be in New Jersey, while the routing data pointed to neither.

The registry record has the same weakness. As DCSO notes, a record's country may mean the country where the network is, or the law it falls under.

We checked the live proxies on our free list on 19 September 2026. Of 774 in RIPE NCC space, 176 sat in a block whose record links a geofeed, spread over 69 different files. We fetched 63 of the files. For the 158 proxies a feed covered, the feed's country matched the registry record's country 88 percent of the time, and the country where our list locates the proxy 72 percent of the time.

So a feed mostly repeats what the registry says. For a proxy sold by country or city, a geofeed is the easiest thing for a seller to change and the weakest thing for a buyer to rely on. It moves an address in the databases that read it, not on the map. A buyer who needs a real location should check more than one database, and the network that announces the address.