How this works

Each address is geolocated, the great-circle distance between consecutive observations is calculated, and that distance is divided by the time between them. If the implied speed is higher than a commercial aircraft could manage — the conventional bound is about 800 km/h — then one person did not make both connections, and you are probably looking at shared or stolen credentials.

That is the whole idea, and on its own it is unreliable enough to be dangerous. The reason is in the next section.

Why it sometimes says “cannot tell”

A geolocation database does not know where a device is. It knows which addresses an operator registered and infers a location, usually a city centroid, and it publishes an accuracy radius alongside — its own statement of how far off that point may be. On mobile networks that radius is routinely 180–200 km, because a phone's traffic can leave the carrier's network in a different region from the handset.

Divide a large distance error by a small time interval and you get an enormous fake speed. Two logins five minutes apart, from one phone, with 200 km of geolocation noise between them, imply thousands of kilometres per hour. A tool that reports a point estimate calls that impossible travel and sends an analyst after a user who never moved.

So instead of one number, this works out a range: the two points as close together as their accuracy radii allow, and as far apart. That produces three possible answers rather than two.

Not plausible — even the most generous reading of the data exceeds the threshold. The geolocation error would have to be larger than reported for one person to have made the trip.
Plausible — even the least generous reading stays under it. Note that physically possible is not the same as legitimate.
Cannot tell — the range straddles the threshold, so the accuracy radii alone decide the answer. This is the honest result for most short gaps, and it means the pair is not evidence in either direction.

What breaks the premise

The whole method assumes the IP address describes where the person is. Several ordinary things make that false, and no amount of arithmetic recovers from them:

A VPN or proxy puts the user wherever the exit node is. Switching one on or off looks exactly like instant travel. Check the addresses with VPN detection before reading anything into the result.
Carrier-grade NAT on mobile networks can move a user between egress points without the user moving at all.
Corporate egress means a laptop on the office network reports the office, and the same laptop on a home connection reports a different city — both correct, neither a journey.
Roaming and satellite links often geolocate to the operator's home country rather than the user's location.

Treat a “not plausible” result as a reason to look closer, never as a finding on its own. It is a triage aid, not evidence.

Common scenarios

“Two countries in one hour”

The classic alert. Enter both addresses and both timestamps. If it returns not plausible, look at whether either address is a VPN exit, then at what the session actually did. If it returns cannot tell, the gap is too short relative to the accuracy radii to conclude anything.

“A dozen logins across a day”

Paste them all. Each consecutive pair is assessed as its own leg and the worst one leads the summary — a single impossible hop in an otherwise ordinary day is exactly what matters, and it is easy to miss by eye.

“The addresses are in the same city”

Expect plausible, and treat it as uninformative. Same-city pairs are the normal case and this tool has nothing useful to add to them; enrich the addresses with IOC enrichment instead.