Then something installed could be altering it. Again we pull the IP Address directly from REMOTE_ADDR or HTTP_X_FORWARDED_FOR. There's no reason for them to be wrong unless the user viewing your site is deliberately trying to spoof that data (of which they can using proxy settings), something installed is altering the values for whatever reason, or your server is.