wnthne on "[Plugin: Wordfence Security] Whois and GEO location don't match and browser version 0.0"

Another question is why does the hackers IP show a Chinese server when the IP is in Kansas? Does this explain why blocking IPs in china didn't keep the hacker out?

100.199.78.125.broad.pt.fj.dynamic.163data.com.cn

See:
http://ip-api.com/100.199.78.125
So how can I tell what is real and what is fake? And how can WordFence tell the difference?
Thanks.