Back in the late 90s when beanie babies, boy bands and the Macerana were winding down, e-commerce was heating up. As more and more people took their spending online, companies went to work, looking for new ways to understand as much as they could about their geographically dispersed audience.
To do that, they started examining how IP addresses could answer the burning question “Where is my audience coming from?”
Concurrently, Digital Element’s plaid flannel-clad founders saw the need for greater tools to understand web traffic and founded the company to do just that.
In the nearly 25 years since, the company has earned over 50 patents related to the advancement of IP intelligence, and has helped organizations worldwide drive greater business intelligence from IP addresses.
In the vein of continued advancement, our R&D team has been busy mining IP address data to define the new set of criteria upon which we can deliver the next generation of IP intelligence. Over the past three years, we have devoted a variety of resources to examining one of the most elusive elements of IP addresses: stability. More specifically, how stable is an IP address at a specific location.
Before we dive into what we’ve found (spoiler alert – it’s eye-opening!) let’s dig into why we went looking in the first place.
The Misunderstood Reality of IP Address Geolocation
In the numerous customer and prospect conversations that we have at Digital Element, we noticed an interesting dichotomy emerge. When it comes to leveraging IP intelligence for audience creation one party puts too much trust in IP address geolocation, while the other party doesn’t trust it at all – “they are too unstable.”
In actuality, both parties are wrong.
While it’s true that IP addresses create a great way to match visitors across websites, the data is really only correct if the visitors are looking at both websites at the same time, which is rarely the case.
How IP Intelligence Reduces Collateral Damage from VPN Geo-Evasion
Blocking VPNs and proxy traffic is necessary for preventing fraud, enforcing compliance, and protecting digital services, but overly aggressive blocking can come at a cost. When legitimate users are mistakenly denied access, organizations experience reduced scale, lost revenue, and poor customer experiences.
This is where advanced IP intelligence makes a true, measurable difference. Rather than treating all VPN or proxy traffic as inherently malicious, our tools can analyze how IPs behave over time, including stability, usage patterns, and infrastructure signals. By understanding whether an IP address consistently operates as part of a known anonymization service—or whether it represents legitimate traffic that occasionally routes through shared infrastructure—organizations can make more precise enforcement decisions.
The result is less collateral damage: high-risk VPN-based geo-evasion attempts are blocked, while legitimate users are preserved. This balance is critical for businesses that need both security and scale, especially in global or high-volume environments.
Why is this? Because IP addresses are unstable. Meaning, that the geo of an IP address that visited website A, may have changed by the time that the same IP address visited website B. Or, said differently, the IP address of a user may have changed between their visits to website A and website B.
So when company A and company B, who invest too much trust in IP address stability, are comparing website data and IP addresses to understand user behavior across their web properties, they should also be examining timestamp information to determine if the user’s traffic was within the same time period. Otherwise, there is a good chance that the traffic was from two different visitors.
On the flip side, those who dismiss IP addresses as too transient are also missing the important point that IP addresses can actually be stable. Especially fixed wifi IP addresses, which happen to account for most of the traffic websites receive.
How is that possible?
Consider your own web browsing habits. The vast majority of people are more likely to browse the web while on wifi in a fixed location, like at home, work, cafe, airport, etc… Comparatively speaking, much less traffic originates from people who are on the go (driving, running errands, out with friends/family, etc…) and don’t have wifi access.
Put simply, you are more likely to visit websites when you are on wifi, rather than when you are on a mobile IP connection. And, don’t forget, cellular carriers and mobile device operating systems prefer that you use wifi over cellular data (mobile IP addresses). If you want to test this, simply turn off your wifi on your mobile device, and see how long before your mobile phone is back on wifi. Answer: no more than 1 day.
So if wifi traffic rules the internet, and we have all been thinking about IP addresses wrong, what is the missing piece of data that can help us reconcile these two opposing opinions? The answer is TIME.
Why Time-Based IP Stability Matters More Than Static Location Data
IP addresses are not static. They are reassigned, repurposed, and reused across different networks, geographies, and services, sometimes rapidly. As a result, IP intelligence that relies solely on a single snapshot in time can quickly become outdated or misleading.
Time-based IP stability introduces critical context. By examining how long an IP address has remained associated with a given location, network, or behavior, organizations gain a clearer picture of whether that IP can be trusted. Recent observations carry more weight than historical ones, and consistent patterns are more meaningful than isolated data points.
This temporal perspective is especially important when identifying VPNs, proxies, and other forms of geo-evasion. Many anonymization services rotate infrastructure frequently, while legitimate consumer ISPs tend to demonstrate more stable behavior over time. Factoring in time helps distinguish between the two, improving accuracy while minimizing false positives.
The next logical question is “For how long?” To answer this question, we must acknowledge that how we talk and think about IP addresses has to be more nuanced so that it considers the dimension of time in addition to geography. Because IP addresses can be stable in a given location, it is best to look at stability in specific blocks of time, like – ‘less than a week’, ‘less than 1 month’, ‘6 months to 12 months’, and ‘more than 1 year’.
Now that we have established how to talk about IP addresses correctly, let’s reveal what our research found. In the tables below you’ll find a summary of IP address stability by location granularity, and time intervals for the US, and UK.
What this chart shows is that the US and UK are similar within a range of how stable IP addresses are in a given location. Around 6% of IP addresses are expected to remain associated with households for longer than 1 year, and around 20% of IP addresses are constantly moving between households from week to week.
The reasons for the stability, or lack thereof, are complicated but at a high level, it comes down to the whims of the Internet service providers (ISP). A larger ISP that serves multiple countries may have different internal rules for allocating IP addresses vs. one that is only serving one country, for example. Note that this is just one reason among many. Comparing a few large ISPs gives a better picture of the dynamic nature of IP address allocation by ISPs.
Here we have compared Vodafone, British Telecom, and Comcast Cable. As we can see Vodafone behaves completely differently than the other two when it comes to IP allocations to their customers.
As you can see from the numbers, the importance of understanding IP address stability is paramount and can support decision-making across numerous business scenarios. Ultimately; however, what this leads to is the notion that there is much more to IP geolocation than the geolocation piece.
How IP Intelligence Reduces Collateral Damage from VPN Geo-Evasion
Blocking VPNs and proxy traffic is necessary for preventing fraud, enforcing compliance, and protecting digital services, but overly aggressive blocking can come at a cost. When legitimate users are mistakenly denied access, organizations experience reduced scale, lost revenue, and poor customer experiences.
This is where advanced IP intelligence makes a true, measurable difference. Rather than treating all VPN or proxy traffic as inherently malicious, our tools can analyze how IPs behave over time, including stability, usage patterns, and infrastructure signals. By understanding whether an IP address consistently operates as part of a known anonymization service—or whether it represents legitimate traffic that occasionally routes through shared infrastructure—organizations can make more precise enforcement decisions.
The result is less collateral damage: high-risk VPN-based geo-evasion attempts are blocked, while legitimate users are preserved. This balance is critical for businesses that need both security and scale, especially in global or high-volume environments.
Preserving Scale by Pairing IP Intelligence with Verification Partners
Modern fraud prevention and compliance strategies rarely rely on a single signal. Instead, organizations combine multiple data sources such as device intelligence, identity verification, and IP analysis to make informed decisions without introducing unnecessary friction.
When used alongside verification partners, time-aware IP data helps validate whether user behavior aligns with expected geographic and network patterns. This layered approach allows organizations to preserve scale, approving legitimate users confidently while escalating only higher-risk interactions for further review.
Rather than forcing hard blocks that reduce reach, IP intelligence enhances partner verification workflows by adding context. It answers not just where an IP appears to be, but whether that makes sense given its recent history.
Time-Stamped IP Location Evidence: IP Forensics vs. Traditional Competitor Data
When disputes arise whether related to fraud claims, chargebacks, policy enforcement, or legal investigations, timing matters as much as location. Knowing where an IP address appears now is often insufficient.
What organizations need is evidence of where that IP was at a specific moment in time.
Digital Element introduces this capability through time-stamped historical IP intelligence, offering visibility into IP behavior and location over extended lookback periods. This contrasts with many traditional IP data providers that focus only on present-day resolution, limiting their usefulness in post-event analysis.
By correlating IP addresses with historical location, network ownership, and usage patterns, organizations can strengthen dispute cases and improve win-rates.
The comprehensiveness of the IP address data that Digital Element provides transcends pure geolocation, offering a wider variety of intelligence that can be used to drive significant outcomes for your business. By incorporating time-based IP stability, organizations move beyond static geolocation toward intelligence that reduces risk, preserves scale, and delivers defensible insight when it matters most.
Partner With Digital Element Today!
Interested in learning more about our new IP address stability insights? Reach out to support@digitalenvoy.com or contact our sales team.
