IP country confusion

“Increased Attack Rate” email keeps listing {One IP number} (Germany) but when I view the live traffic log it shows Russia rather than Germany for that same IP address. Just wondering why the email says the attacks are coming from a different country than the dashboard does.