Blog
Honest writing on IP intelligence.
Working code, clear explainers, and straight talk about what IP signals can and can't do.
Beyond cf.threat_score: when you need structured IP signals
cf.threat_score is great at the edge if you're already behind Cloudflare. Here's when you outgrow an opaque number and need structured, host-agnostic signals in your own code.
Read post →More signals, fewer false positives
Three signals that catch more abuse, three that stop you flagging real users on Apple iCloud Private Relay or Starlink, and one breaking change. Every signal is one input, not a verdict.
6 June 2026 · 5 minSub-30ms IP checks from both US coasts
api.geoq.io now routes to the nearest US region automatically. Same key everywhere, activates globally in about a minute — and an honest note on where EU serving stands.
6 June 2026 · 8 minVerified crawlers, evidence labels, and IPv6: signals you can reason about
The bot you must NOT block, an evidence label that tells you how directly we saw a signal (not how likely it is), and IPv6 parity. The honest-by-design release.
6 June 2026 · 6 minBatch lookups: check 100 IPs in one call
One round trip instead of a hundred. How to use POST /v1/check/batch for log enrichment and backfills — with straight talk on quota: a batch is metered per IP.
17 February 2026 · 8 minUsing IP signals to slow account-takeover attacks
IP signals won't stop ATO on their own — but as one layer they raise the cost of attacks. Here's a pragmatic, honest pattern with working login code.
10 February 2026 · 7 minResidential vs datacenter proxies, explained
Datacenter proxies are easy to spot; residential proxies route through real consumer devices and are deliberately evasive. Here's how to think about both.
3 February 2026 · 6 minWhat is an ASN — and why it matters for IP fraud
The ASN behind an IP tells you whether it's a home ISP, a cloud host or a sketchy network. Here's the concept, how to look it up, and how to use it.
27 January 2026 · 8 minHandling VPN users at a React signup — step up, don't block
Blocking everyone on a VPN is a bad idea. Here's how to wire an IP risk check into a React signup and respond with friction proportional to risk.
20 January 2026 · 7 minHow to detect a VPN by IP address in Node.js
A copy-paste Express middleware that flags VPN/proxy/datacenter IPs and steps up verification — with an honest take on what the signal can and can't tell you.
Start with the free tier. No card.
1,000 lookups a day, every signal, the same transparent risk score. Upgrade only when you outgrow it.