This very likely uses whois/IRR entries and some heuristics to make sense of them. Thus, it is more about which ISP an IP address block belongs to rather than who the physical end user is.

    q3k@anathema ~ $ whois 185.236.240.1 | egrep '(address|org-name)'
    org-name:       Stowarzyszenie "Warszawski Hackerspace"
    [...]
    address:        Warszawa

    q3k@anathema ~ $ curl -s https://ip-api.io/json/185.236.240.1 | jq .organisation,.country_name
    "Stowarzyszenie Warszawski Hackerspace"
    "Poland"

However, this generally doesn't work for multinational ISPs that have blocks in different countries. For instance, take this Google IP address that I got when I spun up a VM in their Belgium DC:

    q3k@anathema ~ $ curl -s https://ip-api.io/json/104.155.39.247 | jq .organisation,.country_name
    "Google LLC"
    "United States"

From what I understand, which admittedly is not much, I believe it is actually a database lookup service that references sections of; or perhaps the whole IP that has been previously recorded as from country X.

I think countries themselves have ranges of IPs allocated to them, but again, not my area of expertise.