[q3k]

This very likely uses whois/IRR entries and some heuristics to make sense of them. Thus, it is more about which ISP an IP address block belongs to rather than who the physical end user is.

    q3k@anathema ~ $ whois 185.236.240.1 | egrep '(address|org-name)'
    org-name:       Stowarzyszenie "Warszawski Hackerspace"
    [...]
    address:        Warszawa

    q3k@anathema ~ $ curl -s https://ip-api.io/json/185.236.240.1 | jq .organisation,.country_name
    "Stowarzyszenie Warszawski Hackerspace"
    "Poland"

However, this generally doesn't work for multinational ISPs that have blocks in different countries. For instance, take this Google IP address that I got when I spun up a VM in their Belgium DC:

    q3k@anathema ~ $ curl -s https://ip-api.io/json/104.155.39.247 | jq .organisation,.country_name
    "Google LLC"
    "United States"