7 DNSBLs, geolocation, ASN, proxy/hosting/mobile detection, and a 0-100 risk score. Drop it into your signup form, your comment system, or your rate-limiter.
curl "https://api.sitetrace.it.com/api/ip?ip=1.2.3.4" | jq{
"ip": "1.2.3.4",
"score": 75,
"risk": "medium",
"dnsbl": {
"checked": 6,
"listed": 1,
"total": 7,
"results": [
{ "id": "spamhaus_zen", "label": "Spamhaus ZEN", "listed": false },
{ "id": "spamcop", "label": "Spamcop", "listed": true, "codes": ["2"] }
/* ... 5 more */
]
},
"geo": { "country": "US", "city": "Mountain View", "isp": "Google", "as": "AS15169 Google LLC", "proxy": false, "hosting": true, "mobile": false }
}Start at 100. For each DNSBL that lists the IP, subtract 10. Then:
| Signal | Adjustment |
|---|---|
| DNSBL hit | −10 each |
| Flagged as proxy (TOR, VPN, public proxy) | −15 |
| Flagged as hosting (data-center, not residential) | −5 |
| Flagged as mobile carrier | +5 |
Risk band: ≥80 low, ≥50 medium, <50 high.
Per DNSBL: which list, whether the IP is listed, and the reason code (different 127.0.0.x answers mean different things — 2 = spam source, 4 = open proxy, 5 = trojan). Geo includes country, city, ZIP, lat/lon, ISP, organization, ASN, and the proxy/hosting/mobile flags. Score and risk are 0-100 + low/medium/high.
Call on every new account creation. If risk === 'high', show a CAPTCHA. If 'medium', require email verification.
Same idea for blog comments, forum posts, anything user-submitted. Cheap enough to call on every submission.
Step-up auth when an IP is high-risk. SMS-code instead of password, or just a longer password requirement.
DNS lookups go through Cloudflare's DNS-over-HTTPS. Geo comes from ip-api.com (free tier, HTTP). The list of DNSBLs we query is on the docs page — adding/removing them is a one-line edit in functions/api/ip.js.