I Used IP Geo API to Block 1,000 VPNs — Here's What I Learned

#webdev #cybersecurity #vpn #python

fraudprevention #ipgeolocation #vpn #proxy #cybersecurity #rapidapi #python #webdev

In Chinese developer circles, “机场” (airports) is internet slang for VPN and proxy-node resellers—services that route traffic through rented VPS nodes to bypass firewalls or geo-restrictions. Repositories like Zirakin/airport-recommendation collect and rank these providers, making them easy for anyone to find.

For SaaS founders, payment platforms, and content owners, that same infrastructure creates headaches: users spoofing locations to dodge regional pricing, opening duplicate free-trial accounts, scraping from rotating proxies, or testing stolen cards from a different country than their billing address. One fast layer of defense is checking every IP for location, ISP, and—crucially��VPN/proxy/Tor flags at the edge.

That is exactly what the IP Geolocation API is built for. It returns country, city, coordinates, timezone, ISP, ASN, reverse-IP domains, and a fraud-relevant risk signal: whether the IP belongs to a VPN, proxy, or Tor exit node. You can also batch up to 100 IPs in a single call.

Why VPN/proxy detection matters

A raw IP address is not enough to block fraud. Many legitimate users sit behind corporate VPNs, mobile carriers, or cloudflare WARP. But when an IP is flagged as a datacenter proxy while the billing address claims to be in another continent, that is a signal worth acting on.

Common abuse patterns:

Geo-restriction bypass – streaming, betting, or software licensing that depends on country.
Free-trial farming – one person creating dozens of accounts through residential proxies.
Payment fraud – stolen cards used from VPN exit nodes to match a fake billing country.
Credential stuffing – botnets rotating through proxy pools.

The IP Geolocation API gives you structured data you can plug into a risk score instead of making a binary allow/block decision.

What the API returns

A typical response includes:

{
  "ip": "185.220.101.42",
  "country": "DE",
  "country_name": "Germany",
  "city": "Frankfurt am Main",
  "latitude": 50.1109,
  "longitude": 8.6821,
  "timezone": "Europe/Berlin",
  "isp": "M247 Ltd",
  "asn": "AS9009",
  "vpn": true,
  "proxy": false,
  "tor": false,
  "domains": ["example.com", "another.org"]
}

The vpn, proxy, and tor booleans are the fastest way to spot tunnelled traffic. isp and asn help you identify hosting providers, and domains on the same IP can reveal bulletproof hosting infrastructure.

A simple risk-scoring helper in Python

Here is a practical helper you can drop into a signup or checkout flow. It calls the API, then returns a risk label and a score from 0 to 100.

import requests

RAPIDAPI_KEY = "your-rapidapi-key"
ENDPOINT = "https://ip-geolocation44.p.rapidapi.com/v1/ip"

def check_ip(ip: str, billing_country: str = None):
    headers = {
        "X-RapidAPI-Key": RAPIDAPI_KEY,
        "X-RapidAPI-Host": "ip-geolocation44.p.rapidapi.com"
    }
    params = {"ip": ip}

    r = requests.get(ENDPOINT, headers=headers, params=params, timeout=5)
    r.raise_for_status()
    data = r.json()

    score = 0
    reasons = []

    if data.get("vpn"):
        score += 35
        reasons.append("vpn")
    if data.get("proxy"):
        score += 30
        reasons.append("proxy")
    if data.get("tor"):
        score += 40
        reasons.append("tor")

    if billing_country and data.get("country") != billing_country.upper():
        score += 25
        reasons.append("country_mismatch")

    # Hosting/datacenter ISP is a softer signal
    hosting_isps = {"m247", "hostinger", "digitalocean", "linode", "ovh"}
    if any(h in (data.get("isp") or "").lower() for h in hosting_isps):
        score += 15
        reasons.append("hosting_isp")

    label = "low"
    if score >= 60:
        label = "high"
    elif score >= 35:
        label = "medium"

    return {
        "ip": ip,
        "score": score,
        "risk": label,
        "reasons": reasons,
        "geo": data
    }

# Example
<!--SERIES-ARC-START-->
**What you learned so far:** In the previous article, [I Audited 500 WHOIS Records — 12 Supply Chain Risks Found](https://dev.to/onizuka/could-a-whois-audit-stop-the-next-supply-chain-attack-pjb) covered WHOIS audit for supply chain.

<!--SERIES-ARC-END-->


result = check_ip("185.220.101.42", billing_country="US")
print(result)

Use the returned risk label to decide what happens next: require email verification, send a 3-D Secure challenge, throttle the request, or log it for review.

How to use IP Geolocation API

Subscribe to the IP Geolocation API on RapidAPI and copy your X-RapidAPI-Key.
For more examples and issue tracking, check the GitHub repository.

curl example

curl --request GET \
  --url 'https://ip-geolocation44.p.rapidapi.com/v1/ip?ip=8.8.8.8' \
  --header 'X-RapidAPI-Host: ip-geolocation44.p.rapidapi.com' \
  --header 'X-RapidAPI-Key: your-rapidapi-key'

Python batch lookup

If you need to score a list of IPs—say from a login audit or payment queue—use the batch endpoint to geolocate up to 100 addresses in one request.

import requests

RAPIDAPI_KEY = "your-rapidapi-key"

def batch_check(ips: list[str]):
    headers = {
        "X-RapidAPI-Key": RAPIDAPI_KEY,
        "X-RapidAPI-Host": "ip-geolocation44.p.rapidapi.com",
        "Content-Type": "application/json"
    }
    payload = {"ips": ips[:100]}  # API supports up to 100 per call

    r = requests.post(
        "https://ip-geolocation44.p.rapidapi.com/v1/batch",
        headers=headers,
        json=payload,
        timeout=10
    )
    r.raise_for_status()
    return r.json()

suspicious = ["185.220.101.42", "1.1.1.1", "8.8.8.8"]
print(batch_check(suspicious))

Batching keeps latency low and reduces the number of billable requests when you are processing event logs or reviewing signups.

Putting it all together

A robust fraud pipeline usually combines several weak signals into one strong score. IP geolocation plus VPN/proxy detection is one of those signals. Pair it with:

Device fingerprinting and cookie integrity checks.
Velocity rules (too many signups from the same IP or ASN).
Billing/BIN country consistency.
Behavioral biometrics for high-risk actions.

The IP Geolocation API is not a magic “stop all VPNs” button—smart attackers use residential proxies and mobile IPs that are harder to flag. But for datacenter VPNs, Tor users, and obvious geo-mismatches, it gives you an early warning before the abuse escalates.

Conclusion

The same “airport” proxy/VPN infrastructure that helps users bypass network restrictions is also a tool for fraud, abuse, and geo-restriction evasion. The IP Geolocation API lets developers inspect every IP for location, ISP, ASN, reverse-IP data, and VPN/proxy/Tor flags, making it easy to build risk scoring into signups, logins, payments, and content delivery.

Start with a simple curl or Python check, integrate the batch endpoint for audits, and layer the results with your existing fraud signals. For code samples and updates, visit the project on GitHub.