Score sign-ups, logins, and payments
Example
See more Fintech use cases → New account → 185.220.x.x · security.isTor: true
Tor exit + hosting ASN → high-risk score, step-up to manual review
Use case
IP Geolocation API for Fraud Prevention & Risk Scoring
Turn a raw IP into risk signals — network type, location mismatches, anonymiser flags, and impossible travel — in one sub-50ms lookup.
Fraud teams don't need another verdict engine — they need signals. One IP lookup tells you whether a request comes from a residential ISP or a datacentre, whether its location matches the billing address, and whether it's hiding behind a VPN or Tor. Feed those into the risk stack you already run.
Who uses it
The teams that lean on this most, in rough order of how often we see it.
The signals it uses
Every one ships in the standard response — no add-ons, no tiers.
connection (ASN / org / type) Tell residential from hosting, cloud, and datacentre traffic — the single strongest fraud signal country / region / city Compare against billing address, shipping, and stated location security (isVpn / isTor / isThreat) Basic anonymiser and known-threat flags to feed risk rules latitude / longitude Distance and impossible-travel checks between sessions is_in_eu Jurisdiction context for sanctions and regional risk policy How different teams put it to work
The same signals, applied to the fraud each industry actually sees.
Catch billing / location mismatches at checkout
Example
See more E-commerce use cases → Billing: US · IP country: NG · ASN: hosting provider
country mismatch + datacentre origin → flag for review, don't auto-decline
Spot account-takeover with impossible travel
Example
See more SaaS use cases → Session A: Berlin → Session B: Lagos (4 min)
impossible travel → raise anomaly, trigger re-auth
Detect multi-account and bonus abuse
Example
See more Gaming use cases → 20 sign-ups → same ASN, same /24, VPN flagged
shared hosting network + VPN → cluster as linked accounts
Protect patient portals from takeover
Example
See more Healthcare use cases → Portal login → hosting ASN · country ≠ last session
datacentre origin + geo jump → step-up verification before access
Screen benefits and eligibility fraud
Example
See more Government use cases → State-benefit claim → IP country: outside state
out-of-jurisdiction origin → route to residency verification
Common questions
Can IP geolocation block fraud on its own?
No — and it shouldn't. It supplies signals, not verdicts. The strongest is network type: a request from a hosting or datacentre ASN behaves very differently from a residential one. Combine that with country, anonymiser flags, and impossible-travel checks, then feed the result into your existing risk engine alongside device and behavioural signals.
What's the single most useful fraud signal in the response?
Connection type and ASN. Most automated fraud and bot traffic originates from hosting, cloud, or datacentre networks rather than residential ISPs. Flagging datacentre origin on a consumer sign-up or checkout is one of the highest-leverage, lowest-false-positive rules you can add.
Won't VPN and proxy users get wrongly blocked?
That's why these are signals, not auto-declines. Plenty of legitimate users browse via VPN. Use the flags to raise risk scores or trigger step-up verification, not to hard-block — and always let a real customer prove themselves through your normal flow.
How fast is it, and does it need a permission prompt?
It resolves server-side from the request IP with a median response under 50ms and needs no browser permission prompt — so it fits inline in a sign-up, login, or checkout flow without adding friction.
Add a risk signal in one request
Free tier: 2,000 lookups/day, no card. Paid plans from $2.50/month. Bulk endpoint available for scoring events at scale.