DEV Community: Network Data Labs

Cloudflare Workers: Add ASN, Hosting and Tor Checks Beyond request.cf

Network Data Labs — Thu, 22 Oct 2026 13:18:15 +0000

Use request.cf as the free baseline, then add confidence, hosting, Tor exit, known VPN network and privacy relay signals, with caching and fail-open.

What `request.cf` gives you, and what it doesn’t

Every Worker request carries a request.cf object with the visitor’s country, region, city, coordinates, ASN and AS organization. For “which country is this visitor in?”, that’s free and instant, and you should use it.

request.cf baseline

export default {
  async fetch(request) {
    const cf = request.cf ?? {};
    return Response.json({
      country: cf.country,          // "US"
      city: cf.city,                // "Mountain View"
      asn: cf.asn,                  // 15169
      asOrganization: cf.asOrganization,
    });
  },
};

What it doesn’t tell you: how precise that city is, whether the IP is a datacenter, a Tor exit or a known VPN network, and anything about IPs other than the current visitor (log lines, webhooks, stored signups). That’s the gap this guide fills.

	`request.cf`	`GET /v0/ip/{ip}`
Country, region, city, coordinates	Yes	Yes
ASN and AS organization	Yes	Yes, plus ISP, prefix and RIR
Accuracy radius and confidence	No	`accuracy_radius_km`, `confidence`
Hosting/datacenter flag	No	`is_hosting`
Tor exit, known VPN networks, privacy relay	No	`is_tor`, `is_vpn`, `is_relay`
Mobile carrier, satellite internet	No	`is_mobile`, `is_satellite`
Any IP, not only the visitor’s	No	Yes, plus `POST /v0/bulk`

Get the client IP

Inside a Worker, the visitor’s address is in the CF-Connecting-IP header. Cloudflare sets it at the edge, so unlike a raw X-Forwarded-For, the client can’t override it.

Call `/v0/ip/{ip}` from the Worker

Store your key as a secret, never in wrangler.toml:

Terminal

$ npx wrangler secret put NDL_API_KEY

Then look up the IP with a Bearer header, cache the result per IP in the Cache API, and fail open if the call is slow:

// src/index.js
const API = "https://api.networkdatalabs.com/v0/ip/";
const TTL = 6 * 60 * 60; // seconds

async function lookup(ip, env, ctx) {
  const cache = caches.default;
  const cacheKey = new Request(`https://ndl-cache.internal/ip/${ip}`);
  const hit = await cache.match(cacheKey);
  if (hit) return hit.json();

  const res = await fetch(API + encodeURIComponent(ip), {
    headers: { Authorization: `Bearer ${env.NDL_API_KEY}` },
    signal: AbortSignal.timeout(500),
  });
  if (!res.ok) throw new Error(`lookup ${res.status}`);
  const data = await res.json();

  ctx.waitUntil(cache.put(cacheKey, new Response(JSON.stringify(data), {
    headers: { "Cache-Control": `max-age=${TTL}`, "Content-Type": "application/json" },
  })));
  return data;
}

export default {
  async fetch(request, env, ctx) {
    const ip = request.headers.get("CF-Connecting-IP");
    let intel = null;
    try {
      intel = await lookup(ip, env, ctx);
    } catch {
      // fail open: fall through to the origin
    }
    return route(request, intel);
  },
};

The Cache API is per data center and costs nothing extra. If you want one shared cache across locations, store the JSON in Workers KV with expirationTtl instead.

Rules: challenge risky traffic, route by country

With the traits in hand, protect sensitive paths and pass the rest of the signals to your origin as headers:

route()

const PROTECTED = ["/signup", "/login", "/checkout"];

function route(request, intel) {
  const url = new URL(request.url);
  const t = intel?.traits ?? {};

  if (PROTECTED.includes(url.pathname) && (t.is_tor || t.is_hosting)) {
    // send to a page with a challenge (Turnstile) instead of a hard block
    return Response.redirect(`${url.origin}/verify?next=${url.pathname}`, 302);
  }

  const headers = new Headers(request.headers);
  headers.set("X-IP-Country", intel?.location?.country_code ?? request.cf?.country ?? "");
  headers.set("X-IP-Confidence", intel?.location?.confidence ?? "unknown");
  headers.set("X-IP-Flags", Object.entries(t).filter(([, v]) => v).map(([k]) => k).join(","));
  return fetch(new Request(request, { headers }));   // pass to origin
}

is_hosting or is_tor on signup/login: challenge (Turnstile) rather than block.
is_vpn (known VPN networks, including major commercial VPN providers): let it through with a flag, and step up on payment.
is_relay (privacy relay): usually ordinary users; just don’t treat the location as precise.
Country routing: use country_code, and only use the city when confidence is high or medium.

Enrich logs in batches with `POST /v0/bulk`

For IPs that aren’t the current visitor, such as Logpush output or a queue of signups, batch them. /v0/bulk takes up to 100 IPs, counts as one request toward the per-minute limit and one per IP toward the daily quota:

// Cron Trigger or Queue consumer: enrich up to 100 IPs per call
async function enrichBatch(ips, env) {
  const res = await fetch("https://api.networkdatalabs.com/v0/bulk", {
    method: "POST",
    headers: {
      Authorization: `Bearer ${env.NDL_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({ ips: ips.slice(0, 100) }),
  });
  const { results, errors } = await res.json();
  return { results, errors };   // results keyed by IP; bad IPs land in errors
}

Latency budget and fail-open

Only call the API on the paths that need it; serve static assets straight from request.cf or not at all.
Keep the timeout tight (around 500 ms) and always fall back to the origin on error.
Cache per IP: repeat visitors cost zero lookups.
Test with a US IP like 8.8.8.8: it returns US / Mountain View with a 50 km radius and medium confidence, plus is_hosting: true and is_anycast: true, so your signup rule should send it to the challenge.

ASN Lookup API: ASN, ISP and organization, plus GET /v0/asn/{asn}
VPN Detection API
Flag risky signups in Python by IP
API Docs

Want to try it? Network Data Labs has a free plan with 1,000 requests/day and the full response schema on every plan.

Flag Risky Signups in Python by IP: Tor, Hosting and Known VPN Networks

Network Data Labs — Thu, 15 Oct 2026 13:21:58 +0000

A FastAPI/Flask recipe that turns IP traits into an allow / verify / review decision, without locking out real users.

Why hard-blocking VPN users backfires

Plenty of legitimate people sign up from a VPN, a privacy relay or a phone on a mobile carrier network. Block them outright and you lose real customers while determined abusers just switch IPs. A better pattern: treat the IP as a risk signal, add friction (email verification, CAPTCHA, manual review) when signals stack up, and keep the reasons on the user record so you can tune later.

Get the real client IP in FastAPI or Flask

Behind Nginx or a load balancer, the socket address is your proxy. Tell the framework which proxy to trust, and never parse X-Forwarded-For yourself: a client can put any IP in it.

# FastAPI / Starlette behind one trusted proxy (Uvicorn)
# uvicorn app:app --proxy-headers --forwarded-allow-ips="10.0.0.5"

from fastapi import Request

def client_ip(request: Request) -> str:
    # With --proxy-headers, request.client.host is the real visitor IP
    return request.client.host

# Flask behind one proxy
from flask import Flask
from werkzeug.middleware.proxy_fix import ProxyFix

app = Flask(__name__)
app.wsgi_app = ProxyFix(app.wsgi_app, x_for=1)   # trust exactly one hop
# request.remote_addr is now the real visitor IP

Look up the IP

One call to GET /v0/ip/{ip} with your key in Authorization: Bearer returns location, network and traits. This async client uses httpx, a one-second timeout and a small per-IP cache, and returns None on failure so signups never break:

# ndl.py
import os, time
import httpx

API = "https://api.networkdatalabs.com/v0/ip/"
HEADERS = {"Authorization": f"Bearer {os.environ['NDL_API_KEY']}"}
_client = httpx.AsyncClient(timeout=httpx.Timeout(1.0), headers=HEADERS)
_cache: dict[str, tuple[float, dict]] = {}
TTL = 6 * 3600

async def lookup(ip: str) -> dict | None:
    hit = _cache.get(ip)
    if hit and hit[0] > time.time():
        return hit[1]
    try:
        r = await _client.get(API + ip)
        r.raise_for_status()
    except httpx.HTTPError:
        return None                      # fail open
    data = r.json()
    _cache[ip] = (time.time() + TTL, data)
    return data

The traits that matter for signups:

is_tor: the IP is a current Tor exit node
is_vpn: known VPN networks, including major commercial VPN providers
is_relay: privacy relay egress
is_hosting: hosting/datacenter detection
is_mobile: mobile carrier networks (an estimate)

A policy table: allow, verify or review

Signal	What it means	Suggested action
`is_tor`	Current Tor exit node	Manual review
`is_vpn`	Known VPN networks, including major commercial VPN providers	Verify email
`is_hosting`	Hosting/datacenter IP: often scripts and bots	Verify email (or CAPTCHA)
`is_relay`	Privacy relay: usually a normal, privacy-minded user	Allow, log it
`is_mobile`	Mobile carrier networks: many users share IPs	Allow; don’t rate-limit by IP alone
Country mismatch + high/medium confidence	IP country differs from the declared one	Verify; review if combined with another signal
Two or more signals	Stacked risk	Manual review

The same table in code, combined with a country check that only counts when confidence is high or medium:

# risk.py
def assess(data: dict | None, declared_country: str | None = None) -> tuple[str, list[str]]:
    """Return ("allow" | "verify" | "review", reasons)."""
    if data is None:
        return "allow", ["lookup_unavailable"]

    t = data.get("traits", {})
    loc = data.get("location", {})
    reasons = []

    if t.get("is_tor"):
        reasons.append("tor_exit")
    if t.get("is_vpn"):
        reasons.append("known_vpn_network")
    if t.get("is_relay"):
        reasons.append("privacy_relay")
    if t.get("is_hosting"):
        reasons.append("hosting_datacenter")

    country = loc.get("country_code")
    confident = loc.get("confidence") in ("high", "medium")
    if declared_country and country and confident and country != declared_country:
        reasons.append("country_mismatch")

    if "tor_exit" in reasons or len(reasons) >= 2:
        return "review", reasons
    if reasons and reasons != ["privacy_relay"]:
        return "verify", reasons
    return "allow", reasons

Wire it into the signup endpoint

# app.py
from fastapi import FastAPI, Request
from pydantic import BaseModel
from ndl import lookup
from risk import assess

app = FastAPI()

class Signup(BaseModel):
    email: str
    country: str | None = None   # from the billing/profile form, e.g. "US"

@app.post("/signup")
async def signup(body: Signup, request: Request):
    ip = request.client.host
    decision, reasons = assess(await lookup(ip), body.country)

    user = create_user(body.email, signup_ip=ip, risk=reasons)
    if decision == "verify":
        send_verification_email(user)        # extra step, not a wall
    elif decision == "review":
        queue_for_review(user)
    return {"status": "ok"}

In Flask it’s the same idea: call assess() with request.remote_addr inside the view (use a sync httpx.Client).

Try it with a US sample IP

Quick check

import asyncio
from ndl import lookup
from risk import assess

async def main():
    data = await lookup("8.8.8.8")
    print(data["location"]["country_code"], data["location"]["city"])  # US Mountain View
    print(data["traits"]["is_hosting"])                                # True
    print(assess(data, "US"))  # ('verify', ['hosting_datacenter'])

asyncio.run(main())

8.8.8.8 is a public DNS resolver in a datacenter, so is_hosting is true and the signup lands in verify. Its country (US, medium confidence) matches the declared one, so there’s no mismatch. For the rest of the logic, unit-test assess() with fixture dicts instead of live IPs:

test_risk.py

def test_tor_goes_to_review():
    data = {"location": {"country_code": "US", "confidence": "high"},
            "traits": {"is_tor": True}}
    assert assess(data, "US")[0] == "review"

def test_residential_us_is_allowed():
    data = {"location": {"country_code": "US", "confidence": "high"},
            "traits": {}}
    assert assess(data, "US") == ("allow", [])

Score existing users in bulk

To backfill risk for users you already have, send their signup IPs to POST /v0/bulk, up to 100 per request. Each IP counts toward the daily quota, and a malformed IP shows up under errors without failing the batch.

Backfill with /v0/bulk

import httpx, os

def enrich(ips: list[str]) -> dict:
    out = {}
    with httpx.Client(headers={"Authorization": f"Bearer {os.environ['NDL_API_KEY']}"}) as c:
        for i in range(0, len(ips), 100):          # max 100 IPs per request
            r = c.post("https://api.networkdatalabs.com/v0/bulk",
                       json={"ips": ips[i:i + 100]}, timeout=10)
            r.raise_for_status()
            out.update(r.json()["results"])        # per-IP failures are in "errors"
    return out

Production checklist

Keep the key server-side in NDL_API_KEY.
Fail open on timeouts and errors; log lookup_unavailable.
Store the reasons with the user, not just the decision.
Recheck at sensitive moments (payment, payout, password reset), not only at signup.

VPN Detection API: known VPN network, Tor exit, privacy relay and hosting flags
IP Fraud Detection API: signals for signup, login and payment risk
Get a visitor’s IP and country in Express
API Docs

Want to try it? Network Data Labs has a free plan with 1,000 requests/day and the full response schema on every plan.

How to Get a Visitor’s IP and Country in Express (Behind Proxies and CDNs)

Network Data Labs — Thu, 08 Oct 2026 18:36:38 +0000

Fix req.ip behind Nginx, load balancers and CDNs, skip the spoofable X-Forwarded-For pattern, and add a cached, fail-open country lookup with an honest accuracy radius.

Why `req.ip` shows your proxy’s IP

In production your Express app almost never talks to the visitor directly. Nginx, a cloud load balancer or a CDN accepts the connection and opens a new one to Node. From Express’s point of view, the “client” is that proxy, so req.ip returns something like 10.0.0.12 or 127.0.0.1.

The real address travels in the X-Forwarded-For header, which each proxy appends to. Express can read it for you, but only if you tell it which proxies to trust.

Configure `trust proxy` correctly

Set trust proxy to match your real topology. With one proxy in front of Node, 1 means “trust exactly one hop”:

Express: trust proxy

const express = require("express");
const app = express();

// One reverse proxy (Nginx, a load balancer) in front of Node:
app.set("trust proxy", 1);

// Or trust only specific proxy addresses / subnets:
// app.set("trust proxy", ["loopback", "10.0.0.0/8"]);

app.get("/whoami", (req, res) => {
  res.json({ ip: req.ip, chain: req.ips });
});

Nginx / one load balancer: app.set("trust proxy", 1), and make sure the proxy sets X-Forwarded-For (in Nginx: proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;).
CDN + load balancer: count the hops (for example 2), or list the proxy subnets explicitly.
Cloudflare in front: Cloudflare sends the visitor’s address in CF-Connecting-IP. Only rely on it if your origin accepts traffic from Cloudflare alone; otherwise anyone can hit the origin and set the header.

Avoid app.set("trust proxy", true) unless every request really passes through proxies you control: it makes Express take the leftmost address in the header, which is client-controlled.

Never trust raw `X-Forwarded-For`

Plenty of snippets read the header directly. That’s spoofable in one line:

Spoofable pattern

// DON'T: anyone can send this header
const ip = req.headers["x-forwarded-for"].split(",")[0];

// $ curl -H "X-Forwarded-For: 8.8.8.8" https://your-app.example/
// -> your app now "thinks" the visitor is in Mountain View

With trust proxy set to a hop count or subnet list, Express walks the chain from the right and stops at the first untrusted address, which is the one your own proxy actually saw. Use req.ip, not the raw header.

Look up the country with a middleware

Once req.ip is right, one call to GET /v0/ip/{ip} returns location, network and traits. This middleware adds a cache, an 800 ms timeout and fails open, so a slow lookup never takes your site down:

// geo.js (Node 18+, global fetch)
const API = "https://api.networkdatalabs.com/v0/ip/";
const KEY = process.env.NDL_API_KEY;
const cache = new Map();            // swap for Redis/LRU in production
const TTL_MS = 6 * 60 * 60 * 1000;

function normalize(ip) {
  return ip && ip.startsWith("::ffff:") ? ip.slice(7) : ip;
}

async function lookup(ip) {
  const hit = cache.get(ip);
  if (hit && hit.exp > Date.now()) return hit.data;

  const res = await fetch(API + encodeURIComponent(ip), {
    headers: { Authorization: `Bearer ${KEY}` },
    signal: AbortSignal.timeout(800),  // latency budget
  });
  if (!res.ok) throw new Error(`lookup ${res.status}`);
  const data = await res.json();
  cache.set(ip, { data, exp: Date.now() + TTL_MS });
  return data;
}

function geo() {
  return async (req, res, next) => {
    const ip = normalize(req.ip);
    try {
      const data = await lookup(ip);
      req.geo = {
        ip,
        country: data.location?.country_code ?? null,
        region: data.location?.region ?? null,
        city: data.location?.city ?? null,
        radiusKm: data.location?.accuracy_radius_km ?? null,
        confidence: data.location?.confidence ?? "unknown",
        traits: data.traits ?? {},
      };
    } catch (err) {
      req.geo = null;                  // fail open: never block the request
    }
    next();
  };
}

module.exports = { geo };

// app.js
const { geo } = require("./geo");
app.use(geo());

app.get("/", (req, res) => {
  const g = req.geo;
  res.json({
    ip: g?.ip,
    country: g?.country,               // "US"
    city: g?.city,                     // "Mountain View"
    radius_km: g?.radiusKm,
    confidence: g?.confidence,
  });
});

Keep the API key on the server (NDL_API_KEY environment variable) and send it as Authorization: Bearer. Don’t call the API from the browser: you would expose the key, and ad blockers often block third-party lookups anyway.

Check `accuracy_radius_km` and `confidence` before acting

Country is reliable enough for defaults like currency or language. City is an estimate. Every response says how much to trust it: accuracy_radius_km is the estimated radius in kilometers, and confidence is high, medium, low or unknown.

Use the city only when it's solid

function usableCity(g) {
  if (!g) return null;
  const precise = g.confidence === "high" || g.confidence === "medium";
  return precise && g.radiusKm !== null && g.radiusKm <= 100 ? g.city : null;
}

// Country for defaults (currency, language); city only when it's solid
const country = req.geo?.country ?? "US";
const city = usableCity(req.geo);

Example: 8.8.8.8

GET /v0/ip/8.8.8.8

$ curl -s https://api.networkdatalabs.com/v0/ip/8.8.8.8 \
    -H "Authorization: Bearer YOUR_API_KEY"

{
  "ip": "8.8.8.8",
  "location": {
    "country_code": "US",
    "region": "California",
    "city": "Mountain View",
    "accuracy_radius_km": 50.0,
    "confidence": "medium",
    ...
  },
  "network": { "asn": 15169, "as_org": "Google LLC", "network": "8.8.8.0/24", ... },
  "traits": { "is_anycast": true, "is_hosting": true, "is_vpn": false, "is_tor": false, ... }
}

8.8.8.8 is an anycast public DNS resolver, so it’s answered from many places at once. The response flags it with is_anycast: true and is_hosting: true, and places it in Mountain View with a 50 km radius and medium confidence, so usableCity() above would accept the city. When the radius is wide or the confidence is low, use the country for defaults and skip the city.

Caching, timeouts and quota

Cache per IP for a few hours. Most of your traffic is repeat visitors, so the cache absorbs most lookups.
Skip what you don’t need: only look up on pages that use location (checkout, pricing, signup), not on every static asset.
Fail open: on timeout or error, fall back to a default instead of returning a 500.
Backfilling logs? Use POST /v0/bulk (paid plans) with up to 100 IPs per request instead of a loop of single lookups.

FAQ

Why do I get `::ffff:203.0.113.5`?

That’s an IPv4 address mapped into IPv6 by Node’s dual-stack socket. Strip the ::ffff: prefix, as the normalize() helper does. Real IPv6 addresses work as-is.

What do I get in local development?

127.0.0.1 or ::1, which are private addresses with no location. The API returns them with is_bogon: true. For testing, hard-code a public IP such as 8.8.8.8.

Why not look up the IP in the browser?

You’d ship your API key to every visitor, ad blockers cut the request, and the client can fake the result. Do it on the server where you already have the right IP.

Can I detect VPN and Tor users with the same call?

Yes. The same response includes traits.is_tor (current Tor exit nodes), is_vpn (known VPN networks, including major commercial VPN providers), is_relay (privacy relay) and is_hosting (hosting/datacenter). Remember that behind those, the location is the exit’s, not the user’s.

IP to Country API: country code, name, continent and is_eu
Flag risky signups in Python by IP
Cloudflare Workers: ASN, hosting and Tor checks beyond request.cf
API Docs: quickstart, endpoints and the full field reference

Want to try it? Network Data Labs has a free plan with 1,000 requests/day and the full response schema on every plan.

DEV Community: Network Data Labs

Cloudflare Workers: Add ASN, Hosting and Tor Checks Beyond request.cf

What `request.cf` gives you, and what it doesn’t

Get the client IP

Call `/v0/ip/{ip}` from the Worker

Rules: challenge risky traffic, route by country

Enrich logs in batches with `POST /v0/bulk`

Latency budget and fail-open

Related

Flag Risky Signups in Python by IP: Tor, Hosting and Known VPN Networks

Why hard-blocking VPN users backfires

Get the real client IP in FastAPI or Flask

Look up the IP

A policy table: allow, verify or review

Wire it into the signup endpoint

Try it with a US sample IP

Score existing users in bulk

Production checklist

Related

How to Get a Visitor’s IP and Country in Express (Behind Proxies and CDNs)

Why `req.ip` shows your proxy’s IP

Configure `trust proxy` correctly

Never trust raw `X-Forwarded-For`

Look up the country with a middleware

Check `accuracy_radius_km` and `confidence` before acting

Example: 8.8.8.8

Caching, timeouts and quota

FAQ

Why do I get `::ffff:203.0.113.5`?

What do I get in local development?

Why not look up the IP in the browser?

Can I detect VPN and Tor users with the same call?

Related

DEV Community: Network Data Labs

Cloudflare Workers: Add ASN, Hosting and Tor Checks Beyond request.cf

What request.cf gives you, and what it doesn’t

Get the client IP

Call /v0/ip/{ip} from the Worker

Rules: challenge risky traffic, route by country

Enrich logs in batches with POST /v0/bulk

Latency budget and fail-open

Related

Flag Risky Signups in Python by IP: Tor, Hosting and Known VPN Networks

Why hard-blocking VPN users backfires

Get the real client IP in FastAPI or Flask

Look up the IP

A policy table: allow, verify or review

Wire it into the signup endpoint

Try it with a US sample IP

Score existing users in bulk

Production checklist

Related

How to Get a Visitor’s IP and Country in Express (Behind Proxies and CDNs)

Why req.ip shows your proxy’s IP

Configure trust proxy correctly

Never trust raw X-Forwarded-For

Look up the country with a middleware

Check accuracy_radius_km and confidence before acting

Example: 8.8.8.8

Caching, timeouts and quota

FAQ

Why do I get ::ffff:203.0.113.5?

What do I get in local development?

Why not look up the IP in the browser?

Can I detect VPN and Tor users with the same call?

Related

What `request.cf` gives you, and what it doesn’t

Call `/v0/ip/{ip}` from the Worker

Enrich logs in batches with `POST /v0/bulk`

Why `req.ip` shows your proxy’s IP

Configure `trust proxy` correctly

Never trust raw `X-Forwarded-For`

Check `accuracy_radius_km` and `confidence` before acting

Why do I get `::ffff:203.0.113.5`?