A roaming eSIM can connect to a cellular network in your current country while websites see an IP in Hong Kong, Singapore, the United States, or elsewhere. This normally does not mean the phone's location is wrong or that the eSIM contains a VPN. Radio access and internet egress are different locations.
Separate:
- where the phone is physically located
- the visited cellular network it uses
- where data reaches the public internet
Roaming can keep the first two local and place the third abroad.
The short answer
- An eSIM is a digital operator subscription profile, not a VPN.
- Connecting to a local cellular network does not guarantee local internet egress.
- A visited network can forward data to a home or regional mobile core.
- Home Routing processes data through the designated home/core network before egress.
- Local Breakout reaches the internet through the visited network or a nearby site.
- Travel eSIMs may use regional hubs rather than one breakout per country.
- The mobile core, packet gateway or UPF, NAT, and egress platform usually determine the public IP—not the radio network itself.
- Mobile IPv4 commonly uses CGNAT, so many users share one public address.
- The displayed city often describes a core gateway or database mapping, not cellular equipment coordinates.
- A roaming IP cannot reliably prove the user's physical location.
Check your eSIM IP, ASN, location, and network type
About the Caylet model (1.6.0): Caylet distinguishes confirmed findings, absence from an available source, and no data. Only valid Scamalytics and AbuseIPDB numbers enter the composite. Other network and provider observations remain separate.
What does an eSIM change?
An embedded SIM lets a compatible device securely download, store, and switch carrier profiles in its eUICC through GSMA Remote SIM Provisioning instead of replacing a plastic card.
A profile can identify a subscription, authenticate it to a network, define operator relationships, and supply or refer to APN/DNN and policy settings. It does not itself operate an encrypted VPN tunnel or select a fake GPS location.
What is data roaming?
Roaming lets a subscriber use a visited mobile network outside the home network's direct coverage. The visited network provides radio access and exchanges authentication, policy, charging, and data-plane information with home or partner systems.
What does the cellular network do?
It establishes the radio link, mobility, and access to the mobile core. It does not necessarily assign the final public IP or provide the internet breakout. The data path can continue across carrier interconnection to a remote packet core.
What does the carrier name in the status bar mean?
It generally identifies the network currently providing access or the profile's displayed operator name. It does not prove that the public IP belongs to that carrier, that traffic exits locally, or that the IP geolocates to the same country.
What is Home Routing?
With Home Routing, data from the visited network is carried back to the home network or another designated core before reaching the internet.
Phone in Japan
→ Japanese visited network
→ carrier interconnection
→ regional/home core in Singapore
→ Singapore internet breakout
Home Routing centralizes policy, charging, security, addressing, and service behavior. It can make operations consistent across countries. The tradeoffs can include longer paths, additional latency, congestion at regional hubs, and an IP country far from the user.
What is Local Breakout?
Local Breakout sends user data to the internet through the visited network or a nearby gateway instead of returning it to a remote home core. It can reduce distance and align content or region more closely with the visit location.
It still does not guarantee an IP in the exact city. A “local” breakout can be regional; GeoIP can be stale; and carrier infrastructure can centralize several cities or countries.
What is regional egress?
Travel eSIM providers often aggregate several destinations into regional hubs. Japan, Korea, and parts of Southeast Asia might share one Hong Kong or Singapore breakout. Europe may use one or a few regional cores. This is operationally simpler than building a separate core in every country.
Home Routing versus Local Breakout
| Item | Home Routing | Local Breakout |
|---|---|---|
| Data anchor | Home/designated core | Visited or nearby network |
| Public IP | Often home or regional country | Often closer to visited country |
| Policy | Centralized | More distributed |
| Path length | Can be longer | Often shorter |
| GeoIP | May differ substantially from user | May be closer, still approximate |
Actual carrier design can be hybrid and can change by APN, plan, protocol, destination, or load.
What roles do APN and DNN play?
An Access Point Name (APN) in 4G and a Data Network Name (DNN) in 5G select or describe the data network and policy context. They can influence gateway selection, IPv4/IPv6 mode, enterprise versus public access, filtering, and roaming routing.
They do not mean “choose any country.” Users should not change APN values casually: an incorrect value can break connectivity, billing, roaming policy, or access to the intended data service. Use the provider's documented settings.
What sends 4G and 5G traffic to the internet?
In simplified 4G architecture, packet gateways anchor data sessions and allocate or translate addresses. In 5G, a User Plane Function (UPF) performs key user-plane forwarding and can be placed centrally or closer to the edge. Carrier NAT, firewalls, policy enforcement, and egress routers can sit around these components.
The radio access location therefore does not directly decide the public IP.
How is the IP assigned?
The mobile network can give the device a private, carrier-shared, or globally routable IPv4/IPv6 address. A gateway or Carrier-Grade NAT may translate many subscriber sessions to one public IPv4.
RFC 6598 reserves 100.64.0.0/10 for carrier shared space. One public address can serve many subscribers, with carrier port and session records distinguishing flows internally. There is no universal public number for how many people share it; deployment, ports, traffic, and policy determine that.
Why can one eSIM show the same IP country in many destinations?
The profile can anchor all supported countries to one regional core. Only the visited radio network changes. That is why a phone in Japan, Thailand, and Malaysia might repeatedly show Singapore.
Why can the same eSIM change egress within one country?
- It connects to a different visited operator.
- Regional load balancing selects another core.
- IPv4 and IPv6 use different paths.
- APN, DNN, or profile behavior differs.
- Maintenance or failover changes gateways.
- GeoIP providers update at different times.
An eSIM's visible network is therefore not guaranteed to be permanent.
Why is the IP company not the local carrier?
ASN and organization may belong to the eSIM's home operator, an MVNO or connectivity aggregator, a core-network partner, an IP transit provider, or a cloud/network platform. The local carrier can supply access without owning the public egress range.
Learn why ASN, ISP, and organization labels differ.
Does Hong Kong or Singapore GeoIP mean VPN use?
No. Cross-border mobile routing produces the same visible country difference without a separate Virtual Private Network. VPN assessment requires known service intelligence, hosting or proxy labels, ASN context, and protocol evidence.
Does an eSIM always use a mobile IP?
The subscriber connects through a mobile network, but databases may label the final egress as mobile, business, hosting, ISP, or unknown depending on range registration and use. An aggregator may operate centralized infrastructure that does not look like a retail carrier range.
Learn the differences among residential, mobile, data center, and business IPs.
How can a foreign IP affect sites and apps?
It can change default content and language, supported-region checks, advertising and search results, latency, and account-security context. A site sees the egress country unless it has other permissioned or first-party location signals.
What does roaming mean for financial accounts?
A foreign or rapidly changing IP can raise risk, especially on a new device or before a sensitive transaction. It is not proof of account takeover. Banks can consider known device, passkey or MFA, prior travel, account history, transaction behavior, and successful step-up verification. A reasonable response is often verification or a temporary control rather than assuming fraud.
What does roaming mean for social and AI services?
Social platforms may examine account clusters, automation, spam, and device history. AI services may also apply supported-region, account-sharing, payment, and request-abuse policies. A regional eSIM egress can therefore affect content or verification even when the subscriber is using the service normally.
Does distant egress always mean slow service?
No. A well-connected regional backbone can outperform a congested local route. However, extra distance and tunneling can add latency. Review round-trip latency to relevant endpoints, throughput, packet loss, jitter, congestion by time of day, and application behavior rather than judging only from GeoIP.
Why is the GeoIP city not the core's exact site?
GeoIP may map the prefix to a registered city, representative metro area, operator Geofeed, or observed location. Anycast, reassignment, and update delays add uncertainty. Treat city coordinates as an estimate.
Why do IP and phone time zones differ?
The phone time zone can reflect device settings or the visited region, while the IP time zone comes from egress GeoIP. Regional Home Routing naturally separates them. Travel, manual settings, and inaccurate GeoIP provide other explanations.
Learn how to interpret IP, time-zone, language, and OS mismatches.
What can DNS and WebRTC show?
A DNS resolver may belong to the visited network, home core, public DNS provider, browser DoH service, or corporate/security infrastructure. A different country is context, not automatic leakage.
WebRTC may expose private candidates, the same public mobile egress, another IPv6 path, or a relay. Classify address type before calling it the user's real IP.
Learn how to interpret DNS and WebRTC leaks.
How can you determine actual egress?
- Check the HTTP public IP.
- Record the visited mobile network shown by the device.
- Compare several GeoIP/ASN sources.
- Compare IPv4 and IPv6.
- Review DNS and WebRTC with their limitations.
- Measure latency to relevant regions.
- Repeat in different countries, partner networks, and times.
No single city label is enough.
How should Caylet present roaming eSIM results?
A public site can directly observe HTTP egress, IP family, approximate GeoIP, ASN/organization, connection and reputation data, browser time zone, and bounded WebRTC results. It generally cannot directly confirm the cellular tower, visited-network identifier, APN/DNN, home operator, core gateway, roaming agreement, or whether Home Routing/Local Breakout was selected.
The result should therefore separate observed egress, database classifications, browser/protocol consistency, and carefully worded inference. Unknowns must remain unknown.
Use Caylet to analyze eSIM egress and environment consistency
Should a roaming eSIM IP stay fixed?
Not necessarily. Mobile sessions reconnect, CGNAT pools rotate, partners and gateways change, and IPv4/IPv6 differ. A stable static IP is a separate product feature, not a general eSIM property.
Is a roaming eSIM safer than public Wi-Fi?
Mobile data avoids the local Wi-Fi operator and ordinary open-network risks, but security still depends on device updates, HTTPS, account authentication, carrier and eSIM trust, and application behavior. It is not automatically anonymous or immune to account risk.
Common misconceptions
- A local cellular connection does not guarantee a local IP.
- An eSIM is not inherently a VPN.
- A local carrier name does not guarantee a local ASN.
- A Singapore IP does not prove the user is in Singapore.
- Mobile CGNAT is not the same as a public proxy.
- One eSIM can use different exits by country and time.
- Local-looking GeoIP does not prove Local Breakout.
Frequently asked questions
Why does Japan show a Singapore IP?
The Japanese network supplies access while a Singapore core provides egress.
Does the eSIM itself change country?
No. The profile and mobile-network architecture determine routing and addressing.
Why is the local carrier shown but the IP is foreign?
Access-network identity and internet-egress identity are different.
Will the IP country remain fixed?
No guarantee. Partner, route, protocol, load, and configuration can change it.
Does a foreign IP mean VPN?
No. Home Routing creates it without a VPN.
Can the IP prove my location?
No. It primarily describes network egress.
Summary
A roaming eSIM profile authenticates mobile service; it does not promise that data reaches the internet locally. Home Routing and regional cores can carry traffic abroad, while Local Breakout can keep it nearer the visited network. APN/DNN policy, packet gateways or UPFs, CGNAT, partner selection, IPv4/IPv6, load balancing, and failover all affect the final IP.
Interpret the public IP as the mobile network's internet breakout, not as cellular-network or device coordinates. Compare ASN, network type, protocols, time zone, and multiple data sources, and preserve uncertainty where a public website cannot see the carrier's internal architecture.
Primary sources
- GSMA, eSIM guides and SGP.22 specification
- 3GPP, 5G architecture and roaming materials
- CTIA, How Roaming Works
- Apple Support, cellular data roaming options
- Cloudflare, geolocated IPs for roaming
- RFC Editor, RFC 6598 and RFC 6888
- MaxMind, Geolocation Accuracy
This article provides general mobile-network and security education. Roaming routes, network labels, and GeoIP change over time and do not represent an official decision by a carrier or third-party platform.