IP Geolocation

Assess risk from a user's IP address — approximate location, network type, and anonymizer use — to detect location spoofing, high-risk geographies, and suspicious access patterns.

---

Overview

IP geolocation derives an approximate physical location and network profile from the IP address a user connects from. During onboarding or authentication, it provides immediate context about where and how a user is connecting — without asking them for anything.

IP geolocation is an estimate, not a precise position. Accuracy is typically strong at the country level and decreases for region and city. Treat it as a risk signal, not a definitive location.

What the check analyzes

When a user connects, the IP address is evaluated for attributes such as:

• Geographic location — Country, region, and city associated with the IP.

• Network and ownership — The internet service provider (ISP) and the autonomous system (ASN) that owns the address space.

• Connection type — Whether the IP belongs to a residential network, a mobile carrier, or a hosting/datacenter provider.

• Anonymizer use — Whether the connection is routed through a VPN, proxy, or the Tor network.

Risk signals it surfaces

Signal	What it may indicate
Connection via VPN, proxy, or Tor	The user may be hiding or misrepresenting their true location.
Datacenter or hosting-provider IP	Traffic may be automated (bots/scripts) rather than a real person on a consumer device.
Location mismatch	The IP country conflicts with the document country, phone country, or stated address.
High-risk or sanctioned geography	The connection originates from a region the organization restricts or watches closely.
Impossible travel	The same account connects from distant locations in a span of time too short to physically travel.

Benefits and use cases

• Onboarding fraud detection — Flag applicants who mask their location or connect from infrastructure rather than a personal device, a common pattern in synthetic-identity and bulk-account fraud.

• Account-takeover (ATO) prevention — Detect logins from unexpected countries or anonymizing networks and trigger step-up authentication.

• Geographic and regulatory controls — Restrict access from embargoed or out-of-scope regions to support compliance obligations.

• Reducing friction for genuine users — A consistent, residential IP that matches the rest of the identity can support a faster, lower-friction path.

• Promotion and bonus-abuse prevention — Identify many accounts originating from the same network or anonymizer, a hallmark of incentive abuse.

Where it fits in the journey

Because it requires no user input, IP geolocation is well suited to running at the very start of a journey as a pre-check, and continuously at each authentication to watch for changes in connection behavior over time.