A few months ago I started digging into where my visitors actually come from. Not "which countries my analytics shows" — actually verifying it by running IP lookups on a sample of visitor IPs.
What I found surprised me. Two countries accounted for 65% of my traffic. But if I'd just looked at my analytics dashboard, I would have guessed wrong about which two.
Why Analytics Data Can Mislead You
Your analytics platform (Google Analytics, Matomo, Plausible) reports visitors by "country" — but that country is determined by IP geolocation, and IP geolocation isn't always accurate.
Three things mess up the data:
- VPNs: A user in Germany on a US VPN shows as US traffic
- Data centers: Traffic from AWS servers might route through Ireland even if you're selling to Australia
- Mobile carriers: Mobile IPs are often assigned to the carrier's central hub, not the user's location
Analytics tools don't fix this. They report what the IP says. Which is why I started running my own checks.
How I Sample Visitor IPs
I use two methods:
Method 1: Log analysis
My server logs contain every visitor's IP. I extract a sample of 500 IPs from a week's worth of logs and run them through an IP lookup tool.
I can't do this for every IP (too slow), but a 500-sample is statistically significant for a site my size.
Method 2: Real-time verification
When I notice a suspicious traffic pattern, I look up the specific IPs in real time. This is how I caught a botnet last year — 400 visits from IPs all in the same /24 range, all from one Bulgarian data center.
What 500 IPs Actually Told Me
Here's the breakdown of my sample:
| Country/Region | % of Traffic | Notes |
|---|---|---|
| United States | 38% | Mostly AWS/Cloudflare IPs — but some real users |
| India | 27% | Legitimate traffic, mostly mobile |
| Germany | 12% | Mapped to specific cities I hadn't targeted |
| Singapore | 8% | Mixed AWS + real users |
| UK | 6% | Consistent |
| Unknown/VPN | 9% | These are useless for targeting |
Two things I got wrong before the analysis:
- I thought Germany was bigger than India. It wasn't even close — India was 2x bigger.
- I thought 20% of US traffic was bots. It was more like 60% — mostly AWS and Cloudflare.
What I Did With This Data
Three changes:
1. Adjusted my content strategy
India was a bigger audience than I'd realized, so I added more examples and use cases relevant to that market.
2. Set up GeoIP blocking
I now block traffic from certain data center ranges that I've identified as bots. That's a topic for another post, but the change cut my server load by 15%.
3. Added country-specific pages
Nothing major — just a few pages that mention region-specific use cases. These brought in about 200 extra sessions per month within 6 weeks.
Why This Matters for Small Sites Too
You might think "I only get 100 visitors a day, this is overkill." It's not.
Small sites have less margin for error. If 40% of your traffic is bots from data centers, your real audience is smaller than you thought, and you're wasting time optimizing for the wrong visitors.
A 30-minute IP sample gives you a much clearer picture.
The Tool I Use
Our IP lookup tool shows:
- Country, region, city
- ISP
- Organization (this is how you spot AWS, Cloudflare, etc.)
- ASN — the network identifier
- Timezone
I keep a text file with the "bad" ASNs I've found — mostly data center providers. Now I can quickly scan a new IP and know within 2 seconds whether it's likely a bot.
If you want to check your own traffic, start with 50-100 IPs. It's enough to spot patterns.
What I Do Now
- Once a month, extract 100-200 IPs from server logs
- Run them through the IP lookup
- Note country, ISP, and ASN for each
- Cross-reference with analytics
- Adjust content and targeting if there are big gaps
Takes about an hour per month. Gives me data analytics alone won't show.
Takeaway
Analytics tells you what the IP says. IP lookup tells you what the IP is. There's a difference, and for a global site, that difference is 30-40% of your data.
Run the sample. You'll learn something.