Hacker News Reader

IP addresses are assigned in blocks, and these blocks are assigned to registered companies - Long story short you can roughly determine whether an IP address is from a datacenter or is "residential" without too much issue - All DigitalOcean droplets are given IP addresses within DO's range for example.

Basically if the IP is from a datacenter - it's likely a VPN.

Yes, it's IP blacklists AFAIK.

And for sites with a lot of traffic, you probably don't even need an external subscription, you can deduce the ranges yourself simply by checking for IP addresses that wind up having logged-in users from all over the world in a short time frame.

Pretty easy to do accurately with a short set of heuristics.

Many geo-ip services also offer VPN or server detection (e.g. is the IP in one of the EC2 ranges).

In a previous job at an online gambling company we found that a large percentage of fraudulent user accounts came from VPNs so ended up banning them at the geo lookup stage.

Easy. How many users are logging in from the same IP address is a big clue.