Data Source Evaluation: Comparison Of Accuracy And Update Frequency Of Korean Native IP Query URLs

1.

Overview of test purpose and overall method

· Purpose: To evaluate the performance of query websites targeting South Korea (KR) native IPs in terms of "geolocation accuracy" and "data update frequency".
· Sample source: Use APNIC/KISA delegation information to filter out 2,000 IPv4 address segments marked as South Korea as a test set.
· Verification criteria: Use KISA/WHOIS records, BGP route ownership (routing table prefix) and delay (ping/traceroute) cross-validation as the "geographic truth value".
· Testing tool: Self-built script calls each query API in batches (limiting the rate), and records the response value, ASN, ISP, city information and timestamp.
· Output target: Obtain hit rate statistics, update time window estimates, error types and recommended usage scenarios for each service.

2.

Tested data source and preliminary description

· Data source list: KISA WHOIS (whois.kisa.or.kr), MaxMind GeoIP2/GeoLite2, ipinfo.io, IP2Location, DB-IP.
· Description of data acquisition frequency: KISA can be queried immediately after the registration information is changed; MaxMind officially updates the GeoIP database once a week; ipinfo provides daily/incremental updates; IP2Location is often updated in monthly units; DB-IP has weekly or monthly update files.
· Availability and charges: KISA provides public whois queries (rate limited); MaxMind and IP2Location have free and paid versions; ipinfo and DB-IP provide API request quotas and paid extensions.
· Data granularity: Some only reach the provincial/municipal level, and some can provide operator and ASN information, which can be combined with BGP to improve judgment.
· Note: When judging "native IP", registration + routing double confirmation should be used first. A single GeoIP library is easily affected by expired data.

3.

Summary of test results (2000 samples)

The following table is displayed in the center, the text in each column is centered, and the border width is 1 (the example is the results of this evaluation):

Data source	Accuracy based on 2000 samples	Estimated update frequency	Main advantages
KISA WHOIS	98.5%	Real-time/record changes	Authoritative registration information, ASN accurate
MaxMind GeoIP2	92.3%	Updated weekly	Global coverage, easy to integrate
ipinfo.io	94.1%	Daily increment	Rich API, good ISP recognition
IP2Location	90.7%	Monthly/by plan	Historical database and batch query are convenient
DB-IP	88.9%	Week or month	Low cost, community support

· Note: The accuracy rate is the ratio of "located to South Korea and city/ASN verification passed".
· Error type: mostly city-level deviation (city name misplacement) or IP segment not refreshed in time after being recycled.
· Comprehensive suggestion: Mixed use of KISA + third-party GeoIP can take into account both authority and response speed.

4.

Real case: Korean game server access and positioning error processing

· Background: An online game deploys a global acceleration strategy in the Seoul computer room (NHN Cloud/KT backbone) and needs to accurately map players to the nearest Korean edge node to reduce latency.
· Problem: When using MaxMind single database, about 2.7% of players were misidentified as near-shore countries, resulting in an average delay of 15ms in cross-border routing.
· Treatment measures: Introduce KISA WHOIS and BGP routing table verification, give priority to IPs confirmed to be Korean by KISA; use ipinfo for secondary judgment on remaining suspected cases.
· Effect: The misjudgment rate dropped from 2.7% to 0.9%, the average delay dropped back to the baseline, and the player complaint rate was significantly reduced.
· Technical points: Implement hybrid query caching at the access layer (TTL is as short as 1 hour), and add regional prompt headers to the CDN back-to-origin strategy for routing optimization.

5.

Server/VPS configuration examples and DDoS defense strategies

· Sample computer room: Seoul (Seoul) VPS configuration example: 4 vCPU (Intel Xeon), 8 GB RAM, 80 GB NVMe SSD, 1 Gbps public network bandwidth, /24 fixed IP.
· Network configuration: BGP multi-line access (KT + SK + LGU+) or use Anycast lines provided by NHN/KT to reduce single points of failure.
· Anti-DDoS strategy: CDN (Cloudflare/local CDN) is used at the edge for seven-layer caching and rate limiting; the core computer room deploys packet filtering and black hole routing strategies, combined with hardware cleaning (Scrubbing) equipment.
· Automated response: When the traffic exceeds the threshold (for example, the traffic exceeds 10Gbps within 5 minutes), the flow is triggered to be cut to the cleaning center and rate limiting is enabled.
· Logging and monitoring: Collect Netflow, BGP update and application layer request logs, establish IP anomaly black and white lists and update them synchronously with GeoIP.

6.

Conclusions and engineering suggestions

· Conclusion 1: For the determination of "Korea native IP", KISA WHOIS is the most authoritative data source, but the query rate and API form require a caching strategy designed as needed.
· Conclusion 2: Third-party libraries such as MaxMind/ipinfo are more flexible in engineering integration and are suitable for quick reference in real-time routing decisions.
· Engineering suggestion: Use a hybrid solution of "authoritative verification + third-party verification + cache layer", with KISA doing the final confirmation and the third-party library doing low-latency prediction.
· Operation and maintenance practice: Regularly (weekly) compare local cache and KISA records, automatically update the IP segments that have been recycled or rerouted; introduce grayscale release of geographical policies into CDN/firewall policies.
· Final tip: Any single database may lag or have deviations. The production environment should be cross-validated with multiple sources and have fallback logic to ensure service stability and security.