Hi Robert,
This Geo locations data ( Country ,State, City,Zip Code,DMA,Latitude, Longitude ) is sent with each mbox request and is based on the visitor's IP address.Hence what you mentioned that Visitor is seeing the experience even when having the IP outside of 5 states may be due to something we term as "Accuracy of IP-based geographical information in Geotargeting" . Please see the link for more information :https://marketing.adobe.com/resources/help/en_US/target/target/c_geo.html . However Can you please us know the IP address for which there were issues . Also, Please share your Target Account login details in a private message so that we can further look into your Audience Defination.
Also, To Create Audience based on Specific IP , you have to use Profile Scripts.
You can access the IP address of visitor using user.header('x-cluster-client-ip’) in a profile script. Please see the below profile script code:
var strIp= user.header('x-cluster-client-ip'); var res = /^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$/.test(strIp); if (res) { return "Valid IP"; } else { return "Invalid IP"; }
The above code checks whether an IP address is a valid IP address or not on the basis of Regular Expression defined in the script and then returns the Valid or Invalid Ip . In your case , you can create a Regular Expression on the basis of your requirements and then check if the visitor ip address is a valid one or not.
Also,If you already know the Ip Address that need to be provided access then , You just have to update the profile script like this :
var strIp= user.header('x-cluster-client-ip'); var res = /^(192.236.17.44)$/.test(strIp); if (!res) { return "Invalid IP"; } else { return "Valid IP"; }
After All the Set up , You can create an Audience named as "Valid Audience" and add "Visitor Profile" as a rule and then choose the above created profile script name as the refinement.

Thanks & Regards
Parit Mittal