If a log file contains IP address of user's host, the program determines user's country, state and city using the IP-to-geolocation database based on Whois records. If the log file contains already resolved IP address (domain name) the program determines country by the top-level domain, but cannot determine state and city. In most cases log files contain unresolved IP addresses. Determining country by IP using the geolocation database is more accurate than using domain names.