they start with WHOIS data and add what they can from there to improve accuracy. Quite a few residential ISPs register blocks of IP addresses (subnets) to a city, town, neighborhood, etc.