IP Geo API vs MaxMind GeoIP2 in 2026: API or MMDB File? An Honest Pick Guide
5-minute read · 2026 pricing · honest assessment
If you’re evaluating IP geolocation in 2026 and MaxMind is on your shortlist, the choice usually isn’t about data quality. MaxMind’s GeoIP2 dataset is the industry baseline — multiple vendors (us included) license parts of it. The choice is about delivery model: do you want a .mmdb file you download weekly and query in-process, or a REST API you call per request? This post lays out where each one wins, without the marketing varnish.
Looking for the full feature matrix? Jump straight to the MaxMind alternative comparison →.
The 60-second take
| What you care about | Choose |
|---|---|
| Sub-millisecond lookup latency, in-process | MaxMind (.mmdb + libmaxminddb) |
| Air-gapped / offline / strict-network environments | MaxMind |
| Highest-fidelity ASN + city dataset on the market | MaxMind |
| Zero database-sync infrastructure to maintain | IP Geo API |
| VPN / Proxy / Tor detection bundled free | IP Geo API |
| EU-only data residency + EUR billing | IP Geo API |
| Real-time updates (no weekly Tuesday sync) | IP Geo API |
| Pay <€100/mo for 1M lookups/mo | IP Geo API |
Pick the row that’s the dealbreaker. If two rows pull opposite directions, the row enforcing a hard architectural constraint wins — for example, “must run inside an air-gapped VPC” beats “we’d prefer EUR billing.”
The real reasons teams switch from MaxMind to an API
The most common switch story we hear isn’t about price or accuracy. It’s about operational fatigue with the .mmdb workflow:
- The weekly sync that no one owns. Someone wired up the GeoIP2 update download three years ago, then left the company. A Tuesday-night cron silently fails because the auth token rotated. Production is now serving 2024 data and nobody notices until a customer reports a mis-routed pricing redirect. Engineering spends a sprint rebuilding the pipeline. With a REST API, the freshness problem is the vendor’s, not yours.
- Library lock-in across services.
libmaxminddbworks great in Go and C, has community bindings in Python and Node, but the lookup-and-cache pattern keeps showing up in every new service. With an HTTP API, a junior engineer can integrate it in any language in an hour without touching CGO bindings. - Threat detection is a separate product. MaxMind sells GeoIP2 Anonymous IP / Insights / Enterprise as separate database files with separate licensing. If you want VPN flags, you’re now syncing two MMDBs. We bundle threat detection into the same response on every tier, including the free 1.000-req/day plan.
- Container image size. GeoLite2-City is ~70MB compressed. Multiplied across hundreds of microservice images, every container registry pull, every cold start, every CI build slows by seconds. An HTTP call adds a few ms; a 70MB image adds dozens.
- EU compliance pressure. Less common but rising fast: Article 44/45 transfer assessments where the DPO wants documented EU-only processing. MaxMind is a US company; the data file processed locally is fine, but the licensing, billing, and support relationship is US-jurisdictional. We’re EU-only at infra, contract, and corporate level.
If none of these hit your stack, the MMDB workflow is genuinely good and you have no switching reason. Stay where you are.
The real reasons to not switch
We try to be straight about this — the fastest way to lose a customer is to oversell the migration.
- You need sub-millisecond latency. A local MMDB lookup is ~50 microseconds. Our median REST latency is ~18ms from Frankfurt — fine for >99% of workloads but instantly disqualifying for ad-tech RTB bidding loops or sub-millisecond fraud rules. Don’t fight the physics.
- You’re in an air-gapped environment. Defense, healthcare PHI, classified workloads. If outbound HTTPS to a third-party domain is forbidden by your network policy, the REST model is a non-starter. MaxMind’s licensable enterprise database is your tool.
- You need MaxMind GeoIP2 Insights or Enterprise depth. Their top tier includes carrier, residential proxy classification, and ISP-level confidence scoring built over years. Our threat block covers the common 90% (VPN/proxy/Tor/datacenter/anonymizer); their Enterprise covers the long-tail edge cases. If you’re a Tier-1 fraud platform with a 50-feature ML pipeline, you’ll likely want both.
- You already have a robust MMDB sync pipeline. If sync is owned, monitored, and boring, you’re not paying the operational tax we’re trying to remove. The migration ROI is small.
What migration actually looks like
For most teams the move is a single function-signature change plus a config flip:
- reader, err := maxminddb.Open("/data/GeoIP2-City.mmdb")
- defer reader.Close()
- var record GeoIP2City
- err = reader.Lookup(net.ParseIP(ip), &record)
+ resp, err := http.Get("https://ipgeo.10b.app/v1/lookup/" + ip)
+ // unmarshal JSON
The non-obvious work is field mapping. MaxMind nests under city.names.en, country.iso_code, subdivisions[0].names.en, traits.autonomous_system_organization. We use flatter paths: city, country_code, region, asn.organization. We publish a MaxMind-shape compatibility view so you can pass ?format=geoip2 and get a response that mostly matches MaxMind’s nested JSON — useful for keeping downstream parsers untouched during a phased rollout.
What we recommend:
- Dual-call for 24-48h. In the request handler, call both the MMDB reader and our API; log every diff to a structured store. Common diffs are city-naming (we use canonical English; MaxMind sometimes returns local-script city names), and ASN organization formatting.
- Cache the IP Geo API response. Most workloads see 60-80% IP repeat-rate within an hour. A 1-hour TTL cache (Redis, Memcached, or local LRU) cuts your billable-request count proportionally — and brings effective latency back into the MMDB range for hot IPs.
- Decommission the MMDB sync pipeline only after the cache hit-rate stabilizes. Keep the cron warm for 7 days as rollback insurance, then revoke the MaxMind license and delete the DB file from your container images.
Full migration guide with curl examples and field-mapping table is on the MaxMind alternative comparison page.
Pricing math at three common volumes
Direct apples-to-apples is hard because the products are licensed differently — MaxMind charges per-database-tier, we charge per-request. The table below is illustrative based on 2026 public list pricing and assumes the most common workload (city-level + threat detection):
| Monthly volume | MaxMind GeoIP2 City + Anonymous IP | IP Geo API | Notes |
|---|---|---|---|
| 100K req | ~$50/mo (City sub) + ~$50/mo (Anonymous IP sub) = $100 | €29 | MaxMind charges per-database not per-request, so volume below the cap is “free” |
| 1M req | same $100 (no per-req metering) | €99 | Crossover point — below ~500K req/mo MaxMind tends cheaper if you ignore ops tax |
| 10M req | $100 (still flat) | €399 (custom) | MaxMind’s per-DB pricing wins on raw cost at high volume |
| Ops cost (sync, monitoring, image bloat) | ~0.5 FTE-day/quarter implied | €0 | Often dominates the unit economics in practice |
Numbers above are list-price snapshots from MaxMind’s public pricing page on 2026-04-16 plus the standard Anonymous IP add-on. Negotiated annual contracts vary. The headline: MaxMind’s database-file model wins on per-request cost at high volume but pushes operational cost onto your team. Our API model inverts that — higher per-request cost, near-zero ops cost. The crossover where each makes sense is volume + ops-tolerance dependent. The 100K-2M req/mo zone where most indie / SMB / scaleup teams sit is where the API model’s total cost of ownership tends to be lower.
Trust check: should you trust this comparison?
Honest disclosure: this post is on the IP Geo API blog. We have a commercial reason to suggest switching. We tried to compensate for that bias by:
- Listing MaxMind’s strengths (latency, offline, dataset depth) in the same depth as ours.
- Naming specific cases where MaxMind is the right pick (sub-ms, air-gapped, Enterprise-tier features).
- Acknowledging that MaxMind wins on raw per-request cost at high volume.
- Linking MaxMind’s product pages directly so you can verify pricing and feature claims yourself.
- Sourcing all numbers from public pricing pages on the date stamped above.
If you spot a factual error, email hello@ipgeo.10b.app — we’ll edit and add a correction note above the fold within 48h. We’d rather be cited as accurate than aggressive.
Try IP Geo API in 5 minutes
# 1. Sign up — no credit card, 1.000 lookups/day on free tier, no MMDB file
open https://ipgeo.10b.app/pricing
# 2. Test against a known IP (Google DNS)
curl https://ipgeo.10b.app/v1/lookup/8.8.8.8 \
-H "Authorization: Bearer $IPGEO_API_KEY"
# 3. If you want a MaxMind-shape nested response
curl 'https://ipgeo.10b.app/v1/lookup/8.8.8.8?format=geoip2' \
-H "Authorization: Bearer $IPGEO_API_KEY"
Sign up free → · Full MaxMind comparison → · API reference →
FAQ
Does IP Geo API license MaxMind data? We license parts of the MaxMind dataset (city + ASN baseline) and augment with our own threat-intel pipeline (VPN/proxy/Tor/datacenter classifiers run by us). The compatibility shim is a response-shape mapper, not a backend proxy.
What’s the difference between MaxMind GeoLite2 (free) and IP Geo API free tier? GeoLite2 is a free downloadable database (city + country) updated monthly with no threat detection. Our free tier is 1.000 API requests/day with the full response including threat block and weekly-or-better data freshness. Different product shapes for different needs.
Will my MMDB-shaped code work as-is with ?format=geoip2?
Mostly. The compatibility shim returns the most common GeoIP2 City fields under the same nested paths. Edge cases (custom traits, ISP-only fields, registered_country distinction) are documented gaps — see the migration guide for the field-by-field map.
Can I run IP Geo API in air-gapped environments? Not today. We’re API-only by design. A self-hosted on-prem appliance is on the 2027 roadmap; pre-2027 air-gapped use cases should stay on MaxMind’s licensable enterprise database.
What happens if your API has an outage? Public status page: https://status.ipgeo.10b.app with a 90-day rolling history. Our SLA is 99.9% (multi-region active-active across Frankfurt + Amsterdam). Most production deployments cache responses with a TTL of 1-24h, which means a brief API outage degrades to stale data, not failed lookups.
Related reading
Practical companion (highly recommended if you’ve decided to switch):
- How to Migrate from MaxMind GeoIP2 to IP Geo API in 2026 → — step-by-step drop-in guide: field-by-field map, code diffs in Python / Node / Go, shadow mode, gradual cutover, rollback plan, and the 7 week-one gotchas.
Drop-in migration guides for adjacent providers (in case you’re consolidating multiple sources onto IP Geo API):
- Migrate from ipinfo.io to IP Geo API —
loc-string + ASN-org regex +Authorization-header gotchas - Migrate from ipstack to IP Geo API — HTTP→HTTPS scheme flip + Security-Module paywall +
connection.asninteger typing - Migrate from ipapi.co to IP Geo API — attribution-backlink scrub +
orgconcatenation regex + free-tier rate-limit fragmentation - Migrate from ipgeolocation.io to IP Geo API — Security-API SKU consolidation +
apiKey-in-URL log-leak hardening +latitude/longitudestring-vs-number gotchas - Migrate from IP2Location to IP Geo API — BIN/CSV/MMDB decommission + IP2Proxy SKU consolidation + USD-annual-to-EUR-monthly billing +
proxy_typeenum-vs-split-booleans gotchas - Migrate from DB-IP to IP Geo API — MMDB/CSV-download decommission + IP-to-Threat / Anonymous / Datacenter SKU consolidation + CC-BY-4.0 attribution-backlink scrub +
countryCode3ISO-3 vs ISO-2 gotchas
If you’re evaluating IP geolocation APIs against multiple providers, the other head-on comparisons in this series may help:
- IP Geo API vs ipinfo.io in 2026 — head-on with the dominant North-American incumbent
- IP Geo API vs ipstack in 2026 — modern EU-hosted alternative for ipstack migrations
- IP Geo API vs ipapi.co in 2026 — pricing, throughput and threat-intel comparison
- IP Geo API vs ipgeolocation.io in 2026 — feature parity, GDPR posture, EUR billing
- IP Geo API vs IP2Location in 2026 — REST-first vs database-download, IP2Proxy bundling, EU residency
- IP Geo API vs DB-IP in 2026 — REST-first vs MMDB-download EU-vs-EU, attribution-free free tier, threat bundling
Industry deep-dives
-
IP Geolocation for Fintech — KYC, Sanctions Screening, Fraud, and EU Residency → — fintech-specific deep-dive: the three IP-control surfaces (KYC country-of-origin, OFAC/EU sanctions, payment-fraud risk), EU-hosted GDPR posture, EUR billing, ASN-level hosting detection, and ≤40 ms median EU-edge latency for 800-1200 ms PSP authorisation budgets.
-
IP Geolocation for Ad-Tech — RTB Enrichment, SIVT/IVT Filtering, and Click-Fraud Attribution → — ad-tech-specific deep-dive: the three IP-control surfaces (RTB bid enrichment with ≤40 ms latency budget + OpenRTB 2.6 device.geo/device.ext, SIVT/IVT filtering with IAB-confirmed datacenter ASN block-list, click-fraud post-back attribution + risk scoring), EU-hosted GDPR + ePrivacy + IAB-TCF v2.2 posture, bundled threat fields, ASN-level granularity, and predictable EUR billing.
-
IP Geolocation for iGaming — Licence-Jurisdiction Enforcement, VPN-Circumvention Scoring, and Self-Exclusion Register Routing → — iGaming-specific deep-dive: the three IP-control surfaces (licence-jurisdiction enforcement with hard-fail-closed posture across MGA/UKGC/KSA/DGOJ/ANJ/ADM/DAS, anti-circumvention scoring with residential-proxy ASN block-list covering Bright Data + Oxylabs + Smartproxy + IPRoyal, self-exclusion register routing to GamStop/CRUKS/ROFUS/Spelpaus/OASIS by IP-country), EU-hosted GDPR + EGBA posture, bundled threat fields, ASN-level granularity, and predictable EUR billing.
-
IP Geolocation for SaaS Monetization — Geo-Pricing, EU-VAT/DAC7 Tax-Routing, Trial-Abuse Scoring, and OFAC/EAR Export-Controls → — SaaS-specific deep-dive: the four IP-control surfaces (PPP-anchored geo-pricing with ≤40 ms checkout-flow budget, EU-VAT-MOSS + OECD DAC7 tax-routing to the right Stripe/Adyen/Braintree/Paddle tax-id, trial-abuse detection with residential-proxy ASN block-list across Bright Data/Oxylabs/Smartproxy/IPRoyal, and OFAC SDN + EAR export-controls feature-gating), EU-hosted GDPR posture, bundled threat fields, ASN-level granularity, and predictable EUR billing.
-
IP Geolocation for Streaming Media — Content Licensing, VPN-Bypass Defence, CDN POP Steering, and SSAI Ad-Insertion → — Streaming-media-specific deep-dive: the four IP-control surfaces (per-territory licensing enforcement with hard-fail-closed HTTP 451 on ambiguous resolve, VPN/proxy/Tor circumvention defence with residential-proxy ASN block-list across Bright Data/Oxylabs/Smartproxy/IPRoyal, CDN POP steering and adaptive bitrate-ladder selection across Akamai/Cloudflare/Fastly/BunnyCDN/Lumen, and SSAI ad-insertion targeting with sports blackout windows via Haversine GPS-distance), ≤40 ms session-init budget on EU edges, studio-grade 24-month audit trail, threat fields on every plan, ASN-level granularity, and EU-hosted GDPR + AVMSD (Directive 2018/1808) posture.
-
IP Geolocation for E-commerce — Tax-Jurisdiction Routing, BIN-vs-IP Carding Defence, PPP-Adjusted Currency Display, and Shipping-Zone Fulfilment Routing → — E-commerce-specific deep-dive: the four IP-control surfaces (EU OSS distance-sales 27-rate map + UK VAT 20% + CH-VAT 7.7% + NO MVA 25% + US Wayfair 13-state nexus + CA GST/HST per-province + AU/SG/IN/BR/JP GST/ICMS/JCT with sanctions hard-stop on IR/KP/SY/CU/BY/RU/MM/VE at checkout; BIN-vs-IP carding + refund-fraud 6-factor weighted score at place-order with residential-proxy ASN block-list across Bright Data/Oxylabs/Smartproxy/IPRoyal/Tier3; PPP-adjusted 7-tier pricebook on first paint with VPN/proxy fall-back to BIN-billing-country; 9-warehouse fulfilment routing FRA/AMS/MAD/MIL/DOV/IAD/LAX/DEL/SIN with DDP/DDU duty pre-calc and lithium/aerosol/prescription destination-gates), ≤40 ms checkout-first-paint budget, DAC7/GDPR/EU OSS audit posture, bundled threat fields on every plan, ASN-level granularity, and EUR billing.
-
IP Geolocation for Healthcare — Cross-Border Telehealth Licensing, HIPAA PHI/EPHI Access Geofencing, EU Patient-Data Residency w/ Schrems II Routing, and Cross-Border Pharma + DEA Schedule Gating → — Healthcare-specific deep-dive: the four IP-control surfaces (cross-border telehealth licensure match at consult-init w/ US IMLC 41-state partial + CA/FL/NY/TX independent + EU MRPQ Directive 2005/36/EC + DE Bundesärztekammer + NL BIG + FR ONM + UK GMC + HTTP 451 hard-fail-closed on jurisdiction-mismatch + NO_RECIPROCITY hard-stop on IR/KP/SY/CU/BY/RU/MM/VE/AF/SO; HIPAA 45 CFR §164.308(a)(4) PHI/EPHI access geofencing w/ clinical-ASN allowlist Epic/Cerner/Allscripts/Mayo/MGH/Cleveland/Kaiser + residential-proxy ASN reject Bright Data/Oxylabs/Smartproxy/IPRoyal/Tier3 + home-office BAA-attested workstation allowlist + risk_score < 30 soft-allow; EU patient-data residency w/ GDPR Art. 9 special-category + EDPB Recommendations 01/2020 supplementary technical measures + Schrems II SCC flag for US-shard + routing to 6 EHR shards EU-FRA/EU-AMS/UK-LON/US-IAD/CA-YYZ/AU-SYD w/ VPN/proxy → fall-back to EU-FRA highest protection; cross-border pharma + controlled-substance gating w/ DEA Schedules I-V + Ryan Haight Act §3 in-person-eval requirement for telemed Rx + EU Falsified Medicines Directive 2011/62/EU originator-country audit + per-country bans for cannabis/CBD/psilocybin/MDMA/kratom), ≤40 ms consult-init budget, HIPAA/GDPR Art. 9/Schrems II/DEA/EU FMD audit posture, bundled threat fields on every plan, ASN-level granularity, and EUR billing.
-
IP Geolocation for Travel + Hospitality — Geo-Rate Enforcement + Dynamic-Pricing per Booking Origin, OTA Carding + ATO Defence, OFAC/EU CONSILIUM/UK OFSI Sanctions Screening at Booking-Init, and GDS + EU OSS / DAC7 Reporting → — Travel/hospitality-specific deep-dive: the four IP-control surfaces (geo-rate enforcement + dynamic-pricing per booking origin w/ 8-tier pricebook T1 EU-Lux 1.00x → T8 Africa 0.75x + VPN/proxy/Tor fall-back to T2_NA_LUX anti-arbitrage + SANCTIONS_HARDSTOP on IR/KP/SY/CU/BY/RU/MM/VE/AF/SO HTTP 451 at search-render + BIN-billing-country pin at checkout; OTA carding + ATO defence at booking checkout w/ corporate-travel-platform ASN allowlist AS-CWT/Amex GBT/BCD/FCM/Egencia/Navan/Amadeus/Sabre fast-lane + consumer-OTA reject on VPN/Tor/relay + residential-proxy ASN block Bright Data/Oxylabs/Smartproxy/IPRoyal/Tier3 + 6-factor carding score threshold ≥70; OFAC + EU CONSILIUM + UK OFSI sanctions screening at booking-init w/ sanctioned-origin hard-stop regardless of session residency + EU 6AMLD compelled-disclosure on VPN/proxy + US-Cuba 31 CFR §515 General License gate + luxury-segment AML thresholds yacht €10K / private jet €20K / villa €5K/night / heli €3K + PEP screen + source-of-funds eval; GDS + inventory routing + EU OSS / DAC7 reporting w/ Amadeus EU/UK + Sabre US/CA + Travelport APAC + 27 EU-MS destination-VAT rates DE 19% → HU 27% + NO 25% + CH 8.1% + UK 20% + DAC7 Directive 2021/514 reportable-platform-operator evidence-log 5-year retention + Jan-31 lead-MS annual report), ≤40 ms search-render budget, OFAC/EU CONSILIUM/UK OFSI/DAC7/EU OSS/HOTREC audit posture, bundled threat fields on every plan, ASN-level granularity, and EUR billing.
Last reviewed 2026-05-08 · IP Geo API team · Comments / corrections: hello@ipgeo.10b.app
Pairs with the full MaxMind alternative comparison page — has the complete feature matrix, migration guide, and pricing snapshot.
Get early access — 50% off for 12 months
First 100 signups lock in 50% off any paid plan for the first year. No credit card required — we’ll email you at launch.