Understanding IP Intelligence: What Your Users' IP Addresses Reveal
This is Part 1 of our 3-part series on IP Intelligence for Fraud Prevention. Part 2: Building IP Intelligence Systems | Part 3: Why IP Intelligence Alone Isn't Enough
A login attempt arrives at your platform. The credentials are correct. Device fingerprint matches previous sessions. Everything appears legitimate—except the IP address tells a different story.
The request originates from a datacenter in Frankfurt, Germany. The account normally logs in from residential broadband in Austin, Texas. The IP has a history of credential stuffing attempts across multiple platforms. The autonomous system belongs to a hosting provider popular with botnet operators.
This is IP intelligence: extracting signal from the numbers that identify every internet connection. While users can spoof emails, rotate devices, and manipulate behavioral patterns, IP addresses provide persistent infrastructure-level signals that reveal true intent. Understanding what IP addresses disclose—and what they obscure—is fundamental to modern fraud prevention.
This article examines the fundamentals of IP intelligence: from basic geolocation to sophisticated threat signal detection, connection type classification, and ASN analysis that distinguishes legitimate privacy-conscious users from systematic fraudsters.
What Is IP Intelligence?
Every device connecting to the internet receives an IP (Internet Protocol) address—a numerical identifier enabling network communication. While users view IP addresses as meaningless numbers, these identifiers encode rich information about connection type, geographic location, network infrastructure, and historical behavior patterns.
IP intelligence is the systematic analysis of IP addresses to extract security-relevant signals. It answers critical questions: Where is this user actually located? Are they connecting through residential internet, mobile networks, or datacenter infrastructure? Does this IP have a history of fraud or abuse? Is the connection being masked through VPNs, proxies, or anonymization networks?
Beyond Simple Geolocation
Early fraud prevention treated IP analysis as geolocation—mapping addresses to countries or cities. Modern IP intelligence goes far deeper, analyzing multiple dimensions simultaneously.
Geolocation remains foundational: country, region, city, coordinates, timezone, and local currency. This data enables detecting impossible travel patterns and geographic inconsistencies indicating fraud.
Connection type classification distinguishes residential broadband, mobile networks, corporate infrastructure, datacenter hosting, and educational institutions. Connection type strongly correlates with fraud risk—legitimate users predominantly connect from residential or mobile IPs, while automated attacks originate from datacenters.
Threat signal detection identifies proxy servers, VPN connections, TOR exit nodes, anonymization services, web crawlers and bots, and known abusive infrastructure. These signals indicate users deliberately obscuring their true location or identity.
Network infrastructure analysis examines ASN (Autonomous System Number), hosting provider identification, ISP classification, and IP range reputation. Understanding who controls the network infrastructure reveals whether connections come from legitimate ISPs or suspicious hosting providers.
Historical reputation aggregates behavior across time and platforms: spam and abuse reports, fraud transaction history, credential stuffing participation, botnet association, and velocity patterns. An IP's past predicts its future behavior.
The Intelligence Layer
Raw IP data becomes intelligence through context, correlation, and pattern recognition. A VPN connection from a new device using a disposable email during impossible travel patterns signals high fraud risk. The same VPN from a recognized device with established behavior and legitimate email suggests privacy-conscious legitimate use.
This contextual analysis—combining IP intelligence with device fingerprinting, email reputation, and behavioral patterns—creates accurate fraud detection with minimal false positives. As explored in our articles on credential stuffing and multi-accounting, no single signal provides perfect detection. Multi-layered intelligence succeeds where individual signals fail.
Geolocation Intelligence: Beyond Coordinates
IP geolocation maps addresses to physical locations, but accuracy, granularity, and interpretation require nuanced understanding.
Accuracy and Limitations
Country-level geolocation achieves 95-99% accuracy for most IPs. Regional databases reliably identify which country hosts an IP address, making country-based blocking or verification practical for many use cases.
City-level accuracy drops to 55-80% depending on IP type and location. Residential broadband IPs typically provide reliable city identification. Mobile network IPs show lower accuracy because carriers route traffic through distant gateway infrastructure—a user in rural Oregon might appear to be in Portland due to carrier routing.
Latitude and longitude coordinates are typically accurate within 25-50 miles for residential connections. These coordinates represent approximate locations rather than precise addresses. Using coordinates for fine-grained geofencing creates excessive false positives.
Corporate networks introduce additional complexity. Large companies route international office traffic through headquarters, making employees worldwide appear to connect from corporate headquarters locations. A remote employee in Singapore using corporate VPN appears to be in New York if that's where headquarters routes traffic.
Rich Geographic Context
Beyond simple coordinates, modern IP intelligence provides contextual geographic data valuable for fraud detection and user experience optimization.
Administrative divisions include country, state/province, city, and postal codes. This granularity enables detecting mismatches between billing addresses and connection locations—a strong fraud indicator explored in our multi-accounting analysis.
Timezone and local time validate that user activity patterns match expected behavior. A user claiming to be in London but consistently active during US Eastern timezone hours raises suspicion. Impossible travel detection relies partly on timezone consistency analysis.
Currency and economic data help assess transaction risk. Users in high-GDP countries purchasing with payment methods from low-GDP regions warrant scrutiny. Currency mismatches between IP location and payment details indicate potential fraud.
ISP and carrier identification distinguishes residential broadband, mobile carriers, corporate networks, and educational institutions. This classification provides critical context for risk assessment—residential ISPs suggest legitimate home users, while hosting providers indicate potential fraud infrastructure.
Company and Organization Detection
Advanced IP intelligence identifies corporate and institutional networks through reverse DNS lookups, WHOIS data analysis, and proprietary databases mapping IP ranges to organizations.
When IP addresses resolve to major corporations—banks, technology companies, consulting firms—this context informs risk assessment. An account creation from a major corporation's network receives different treatment than one from an anonymous datacenter.
Educational institutions, government agencies, healthcare providers, and other identifiable organizations provide legitimacy signals. However, corporate network detection must account for VPN concentrators routing remote employee traffic, shared infrastructure serving multiple organizations, and IP address reassignments over time.
Connection Type Classification: What the Infrastructure Reveals
The type of network infrastructure connecting users to the internet strongly correlates with fraud risk. Understanding connection type classification enables intelligent risk assessment.
Residential vs. Datacenter IPs
The fundamental distinction separates residential internet connections (home broadband, fiber, DSL, cable modems) from datacenter infrastructure (cloud hosting, dedicated servers, VPS instances).
Residential IPs indicate legitimate home users. Internet service providers like Comcast, Verizon, AT&T, and international equivalents allocate these addresses to subscribers. Residential connections show characteristics of human users: variable activity patterns, typical browsing behaviors, and connection from consumer devices.
Datacenter IPs belong to hosting providers—AWS, Google Cloud, Microsoft Azure, DigitalOcean, OVH, and thousands of smaller providers. Legitimate users rarely browse from datacenters. These IPs typically indicate automated systems, bots, credential stuffing infrastructure, web scrapers, or attackers using cloud servers for anonymity.
The distinction matters enormously for fraud prevention. Analyzing credential stuffing attacks reveals 90%+ originate from datacenter IPs. Trial abuse automation runs on cheap cloud instances. Review manipulation campaigns deploy datacenter-hosted bots. While false positives exist (developers accessing platforms from work infrastructure, legitimate APIs using datacenter hosting), datacenter IPs warrant elevated scrutiny.
Mobile Network Detection
Mobile carrier IPs—cellular connections from smartphones and tablets—present unique characteristics requiring specialized handling.
Mobile IPs frequently change as users move between cell towers or carrier routing adjusts. A user might receive different IPs within minutes despite not physically relocating. This instability complicates IP-based tracking and reputation building.
Carrier gateway routing affects geolocation accuracy. Mobile carriers route traffic through centralized gateways that may be hundreds of miles from the user's actual location. A mobile user in rural Montana might appear to be in Denver where the carrier's regional gateway operates.
Mobile network detection matters for user experience and fraud prevention. Legitimate mobile users shouldn't face friction due to IP changes or geolocation uncertainty. However, mobile proxies—services offering residential mobile IPs for anonymization—require detection to prevent fraud.
Proxy and VPN Detection
Proxy servers and VPN services mask users' true IP addresses, introducing detection challenges and privacy considerations.
Commercial VPNs (NordVPN, ExpressVPN, Surfshark, ProtonVPN) route user traffic through remote servers, making users appear to connect from VPN server locations. These services maintain known server IP ranges that can be identified through comprehensive databases.
Residential proxy networks (Bright Data, Oxylabs, Smartproxy) provide IP addresses belonging to real residential connections, making them harder to detect than datacenter proxies. Fraudsters prefer residential proxies because they appear legitimate while providing anonymity.
Corporate proxies and VPNs enable remote workers to access company networks securely. These legitimate enterprise VPNs shouldn't trigger fraud alerts, requiring distinction from consumer anonymization services.
Web proxies act as intermediaries forwarding HTTP requests. They're detectable through HTTP headers (X-Forwarded-For, Via, X-Real-IP) revealing proxy presence, though sophisticated proxies strip these headers.
Detection approaches include maintaining databases of known VPN/proxy server IPs, analyzing HTTP headers for proxy signatures, detecting WebRTC leaks revealing true IPs, identifying inconsistencies between claimed and actual locations, and recognizing velocity patterns impossible without proxy rotation.
TOR Exit Node Identification
TOR (The Onion Router) provides strong anonymity by routing traffic through multiple encrypted nodes. TOR exit nodes—where traffic exits the TOR network to reach destinations—are publicly listed, making detection straightforward.
TOR usage correlates with both legitimate privacy needs and malicious intent. Privacy-conscious users, journalists, activists, and individuals in oppressive regimes legitimately use TOR. However, fraudsters also leverage TOR's anonymity for account takeover, credential stuffing, and marketplace fraud.
Detection is binary—IP addresses either appear on TOR exit node lists or don't. The challenge lies in response: blanket blocking alienates legitimate users, while permissive policies enable fraud. Context-aware risk scoring treats TOR as one signal among many rather than an automatic block trigger.
Threat Signal Detection: Identifying Malicious Infrastructure
Beyond connection type, specific threat signals identify IPs associated with malicious activities.
Abusive IP Detection
Historical abuse tracking identifies IPs participating in spam campaigns, DDoS attacks, port scanning, vulnerability exploitation, brute force attempts, and phishing operations. Threat intelligence feeds aggregate reports from thousands of organizations, creating shared databases of known malicious infrastructure.
When an IP address shows up in abuse databases, it indicates either:
- Compromised device: Legitimate user's computer infected with malware
- Shared infrastructure: Multiple users on same IP, one malicious
- Dedicated attack infrastructure: Intentionally malicious operator
The distinction matters for response. Compromised residential IPs might warrant temporary blocking with user notification. Dedicated attack infrastructure deserves permanent blocking.
Bot and Crawler Detection
Web crawlers include legitimate search engine bots (Googlebot, Bingbot) and malicious scrapers stealing content or conducting reconnaissance. Detection approaches identify user-agent strings (though easily spoofed), analyze access patterns (crawlers hit hundreds of pages rapidly with no typical user behavior), examine IP ranges belonging to known crawler services, and detect missing browser fingerprints (headless browsers used by scrapers).
As explored in our browser fingerprinting guide, combining IP analysis with device fingerprinting creates robust bot detection. Legitimate search engine crawlers should be allowed (they drive SEO traffic), while malicious scrapers warrant blocking.
Reserved and Special-Use IPs
Certain IP ranges have special meanings in network infrastructure:
Private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) are not routable on the public internet. Seeing these in requests indicates misconfigured proxies or sophisticated attackers manipulating headers.
Loopback addresses (127.0.0.0/8) refer to the local machine. Requests appearing to come from loopback IPs are impossible from external users.
Reserved blocks (0.0.0.0/8, 240.0.0.0/4) are not allocated for general use. Their appearance suggests configuration errors or manipulation attempts.
Cloud provider internal ranges occasionally leak through misconfigurations. Detecting these patterns reveals infrastructure details attackers might prefer to hide.
Reputation Scoring Frameworks
Comprehensive threat detection aggregates multiple signals into unified reputation scores:
Positive indicators include clean history across monitoring periods, legitimate ISP or corporate network, consistent residential connection patterns, and absence from abuse databases.
Negative indicators include documented spam or fraud participation, presence on multiple blocklists, association with credential stuffing campaigns, rapid IP rotation patterns, and datacenter hosting by providers popular with attackers.
Reputation scores typically range 0-100, with higher scores indicating greater trustworthiness. These scores inform risk-based authentication and fraud prevention policies.
ASN Analysis: Understanding Network Ownership
Autonomous System Numbers (ASNs) identify organizations controlling IP address blocks, providing crucial context for fraud detection.
What ASNs Reveal
Every IP address belongs to an autonomous system—a collection of IP networks under single administrative control. ASNs identify:
Internet Service Providers: Residential ISPs like Comcast (AS7922), Verizon (AS701), AT&T (AS7018) indicate home users. These ASNs carry predominantly legitimate traffic.
Hosting Providers: Cloud platforms like Amazon (AS16509), Google Cloud (AS15169), DigitalOcean (AS14061) host both legitimate services and fraud infrastructure. Fraud rates vary significantly between providers based on abuse policies.
Mobile Carriers: Cellular providers like T-Mobile (AS21928), Verizon Wireless (AS6167) identify mobile network connections with their unique characteristics.
Corporate Networks: Large organizations operate their own ASNs. Major corporations, Microsoft (AS8075), universities, and government agencies are identifiable through ASN lookups.
Content Delivery Networks: CDNs like Cloudflare (AS13335), Fastly (AS54113) proxy traffic for thousands of websites. Detecting CDN ASNs prevents false attribution—the CDN IP isn't the user's real IP.
ASN-Based Risk Assessment
Different ASNs correlate with different fraud risks based on historical patterns.
High-risk ASNs include hosting providers with lax abuse policies popular with fraudsters, VPN services used primarily for anonymization, anonymous proxy networks, and datacenter providers in jurisdictions with limited law enforcement cooperation.
Medium-risk ASNs include smaller hosting providers, residential ISPs with known botnet problems, mobile carriers in certain regions, and ASNs showing elevated fraud rates in threat intelligence.
Low-risk ASNs include major residential ISPs with good abuse handling, large corporate networks, educational institutions, and government networks.
ASN-based scoring must balance legitimate use and fraud potential. Even high-risk ASNs carry some legitimate traffic. Context from other signals prevents excessive false positives.
ASN Change Detection
Monitoring ASN consistency across user sessions reveals suspicious patterns. Legitimate users typically connect from consistent ASNs—the same residential ISP or mobile carrier. Frequent ASN changes suggest proxy rotation, VPN server hopping, or deliberate obfuscation.
When a user's ASN changes from residential ISP to datacenter hosting, that's a strong fraud signal. When corporate network ASN switches to anonymous proxy ASN, additional verification is warranted. ASN change velocity analysis detects automation and evasion attempts.
Conclusion: The Foundation of Fraud Detection
IP intelligence provides fundamental infrastructure-level signals that reveal user intent and detect fraud attempts. From basic geolocation to sophisticated threat detection, connection type analysis, and ASN reputation scoring, IP addresses disclose rich information about who's connecting to your platform and why.
However, as we'll explore in Part 2, implementing effective IP intelligence systems requires careful attention to data sources, risk scoring frameworks, integration patterns, and performance optimization. Building production-ready IP intelligence involves more complexity than initially apparent.
And as we'll examine in Part 3, IP intelligence alone—however sophisticated—cannot provide complete fraud prevention. Modern attacks require multi-signal detection combining IP intelligence with email validation, device fingerprinting, and behavioral analysis for accurate risk assessment.
Continue reading: Part 2: Building IP Intelligence Systems
This article is Part 1 of our 3-part series on IP Intelligence for Fraud Prevention:
- Part 1: Understanding IP Intelligence (this article)
- Part 2: Building IP Intelligence Systems
- Part 3: Why IP Intelligence Alone Isn't Enough