IP Geolocation for SaaS Fraud Detection — Sub-50ms at the Edge

Why IP signals matter\n\nIP geolocation is the cheapest fraud signal you can add. It costs nothing at request time, works at the edge, and catches the 30% of abuse that comes from:\n\n- Obvious data-center IPs on signup flows\n- Known Tor exit nodes for anonymous abuse\n- Geographic mismatches (card country ≠ IP country)\n- Impossible travel (logged in from Seoul 2 min ago, now Seoul → London?)\n- Residential vs cloud — retail fraud tends to be cloud, real users are residential\n\n## The minimum pipeline\n\n``ts\nasync function scoreSignup({ email, ip }) {\n const geo = await fetch(https://api.lazy-mac.com/ip-geo/api/v1/lookup?ip=${ip}).then(r => r.json());\n\n let score = 0;\n if (geo.is_datacenter) score += 40;\n if (geo.is_tor) score += 80;\n if (geo.is_vpn) score += 20;\n if (geo.country !== email.country) score += 10;\n if (geo.asn_rank > 10000) score += 15; // low-reputation ASN\n\n return { score, reasons: geo };\n}\n`\n\nThreshold at ~50 for friction (require email verification), ~80 for hard block.\n\n## Why edge latency matters\n\nIP lookups run on every signup, login, payment, password reset, sensitive API call. At 100/day/API sub-50ms means you never notice it. At 500ms (third-party lookup service), you'll be forced to skip it on the hot path.\n\nlazymac IP Geo API runs at Cloudflare edge — sub-50ms globally. Free 100/day. Pro $9.99/mo unlimited.\n\n## Data available\n\n- Country, region, city, postal code\n- Coordinates + timezone\n- ISP name, ASN, ASN rank\n- is_datacenter, is_tor, is_vpn, is_proxy` flags\n- Currency hint for display\n\n## Compose with other signals\n\nIP geolocation is one of many weak signals. Stack it with:\n\n- Email validation — catches disposable domains\n- Tech stack detector — referrer URL → legit site?\n- Password strength — zxcvbn score on signup pw\n\nAll 30+ signals available via one API key in MCP Pro $29/mo.

Support the work: MCP Pro $29/mo · MCPWatch Pro Report $49 · more posts