- Since April 2022, Starlink’s IP geolocation file has shown substantial growth, expanding from 1,535 to 2,789 lines and increasing the number of unique countries from 41 to 169.
- Most of this growth has occurred outside the United States, with notable increases in both IPv4 and IPv6 entries and a shift in popular prefix sizes.
- Changes to the Starlink IP geolocation file occur primarily between 20:00 and 2:00 UTC.
In the initial months following Russia’s invasion of Ukraine in 2022, Internet service, like the rest of the country, was under attack. As parts of the country descended into war zones, communication disruptions became regular events, caused by everything from cyber attacks to power outages and fiber cuts.
As the world rallied to Ukraine’s defense, Elon Musk pledged the support of Starlink, his revolutionary low-earth-orbit (LEO) satellite-based Internet service. Ever since that first batch of Starlink antennae arrived in Kyiv that March, Starlink has played a vital role in keeping Ukraine (especially its military) connected to the Internet.
Soon after the arrival of Starlink service in Ukraine, I began downloading Starlink’s IP geolocation file every two hours. This month I passed three and a half years of snapshots of these files—likely the largest collection of Starlink IP geolocation data outside of Starlink itself.
In this post, I’ll describe some of the trends we can see over time, some highlights, and an interactive visualization of the entire IP geolocation dataset.
What is the Starlink IP geolocation file?
An IP geolocation file is simply a CSV file containing the self-reported geolocations of the IP ranges originated by a network, as defined by RFC 8805. Each line is an entry containing four fields: IP prefix range, two-letter country code, region code, and city label.
This is an example line:
129.222.112.0/24,CA,CA-MB,Winnipeg,Which can be interpreted as:
Prefix: 129.222.112.0/24
Country: CA
Region: CA-MB
City: WinnipegHowever, accuracy is not assured, and there is no guarantee that the listed IP ranges are in use or even routed.
When Starlink user terminals (aka Dishy McFlatface antennae) connect to the Internet, they are assigned an IP address (or residential users a CGNAT-Gateway bearing such) that corresponds to their location in the IP geolocation file. This ensures that Starlink users are provided appropriate access to geofenced online media and receive the appropriate language localization to international websites, like www.google.com.
Starlink users communicate with the Internet by either having their signal relayed back to a ground station within the footprint of the satellite(s) they are connecting to, like traditional bent-pipe satellite Internet, or use optical inter-satellite laser links (OISL) to hop from one satellite to another, traversing space until coming down at a faraway ground station. Starlink is the first large-scale satellite operator to employ OISLs.
Lastly, these entries can also be placeholders for future locations. For example, at the time of this writing, Starlink has not yet been authorized for use in India, yet there have been entries for Mumbai in the IP geolocation file for the entire duration of the analysis period.
2406:2d40:a000::/40,IN,IN-MH,Mumbai,Having said all that, the contents of Starlink’s IP geolocation file tell the story of this singular Internet modality’s evolution over time. Now, more than 3.5 years after beginning to record this data, it’s time for it to tell us its stories.
Planetary Expansion
In the time we’ve been downloading it, Starlink’s IP geolocation file has grown from 1,535 to 2,789 lines long (currently 2,151 entries for IPv4 and 638 for IPv6). The number of unique countries contained in it has also grown from 41 to 169.
Figure 2 shows the growth of the IP geolocation file from April 2022 to October 2025 by tracking the amount of unique IP space for IPv4 and the number of entries for IPv6, since the ranges can be extremely large. In either case, most of the growth has occurred outside of the United States (blue).
Additionally, both IPv4 and IPv6 experienced significant increases in recent weeks: the overall IPv4 count jumped by 32,000 unique addresses (8%) on 26 September, while the number of IPv6 entries increased by 73 (13%) on 4 October.
The size of the IP ranges has also evolved over the years. For IPv4, the most popular size of the IPv4 entry was once a /27, representing 32 unique IP addresses. Now, the most popular size is /24 (256 addresses), followed by /25. A /23 appeared for just one day in March 2024, when 129.222.98.0/23 was temporarily assigned to Nairobi, Kenya.
| IPv4 prefix sizes | April 2022 | July 2025 |
|---|---|---|
| /24 | 592 | 1379 |
| /25 | 56 | 471 |
| /26 | 60 | 139 |
| /27 | 766 | 156 |
| /28 | 0 | 6 |
On 25 September 2025, Starlink added another 126 /24 IPv4 prefixes to its IP geolocation file (Figure 2).
Table 2 shows that the evolution of the distribution of IPv6 prefix sizes is more profound. This likely relates to the service’s expansion of IPv6-based Internet services over this period of time. Back in April 2022, the 61 IPv6 entries were all one size: /36 (representing 2^92 or a mere 4.95 sextillion unique addresses). Now there are hundreds of IPv6 entries with /42’s and /40’s being the most popular.
| IPv6 prefix sizes | April 2022 | July 2025 |
|---|---|---|
| /36 | 61 | 0 |
| /38 | 0 | 0 |
| /40 | 0 | 383 |
| /41 | 0 | 24 |
| /42 | 0 | 205 |
| /45 | 0 | 1 |
| /46 | 0 | 1 |
| /47 | 0 | 2 |
| /48 | 0 | 21 |
| /49 | 0 | 1 |
On 3 October 2025, Starlink added another 86 /40 IPv6 prefixes to its IP geolocation file (Figure 3).
Since we record changes every two hours, we also observe patterns of when the file changes the most during the course of a day. Figure 4 depicts the number of line changes by time of day in the past 3.25 years—most changes take place between 20:00 and 02:00 UTC, while none take place around 14:00 UTC.
When we plot these changes by time-of-day over time (Figure 5), we can see both a general lack of activity between 06:00 and 18:00 UTC and an uptick of activity from the end of February 2024.
Since its arrival a few years ago, Starlink has rapidly reshaped the global Internet landscape. Analysis of 3.5 years of the LEO operator’s published IP geolocation data—likely the largest collection outside of Starlink itself—reveals the service’s dramatic growth.
In the next part of this analysis, I will explore the arrival of specific countries in the IP geolocation file using an interactive visualization, discussing the most noteworthy arrivals in this extensive dataset.
Doug Madory is an Internet infrastructure analyst known for his detailed research into global network connectivity, BGP routing behavior, and large-scale Internet disruptions.
The views expressed by the authors of this blog are their own and do not necessarily reflect the views of the Internet Society.
Photo: Kyiv Mayor Vitali Klitschko and his brother Wladimir with delivered Starlink terminals during the Battle of Kyiv on 15 March 2022. Source: Kyiv City Hall VIA Wikimedia.
