Verifying an address matches its stated postal code before checkout
A mismatched postal code and city on an order form looks like a small typo until it turns into a delivery sent to the wrong part of the country entirely.
Detecting fraud rings by shared IP ranges
A single fake account is a nuisance. A dozen fake accounts that all appear unrelated, until you notice they log in from network addresses that sit right next to each other, is a coordinated operation, and a marketplace's trust and safety team started finding exactly this pattern once it began looking at IP addresses in terms of the network they belonged to rather than as isolated data points.
Individually, none of the flagged accounts looked obviously suspicious. Different email addresses, different names, different listing categories. What connected them only became visible when the team started resolving each account's login IP addresses through /v1/ip and looking at the ASN and organization fields alongside the address itself, then grouping accounts by which network range those addresses fell into.
This is also the reasoning behind how My Geocode's own free allowance works: usage is counted per /24 network for IPv4 addresses and per /48 for IPv6, shared across every account or key using addresses from that same network, rather than treated as entirely separate per individual address. Addresses close together on a network genuinely tend to belong together, whether that's a household, an office, or in less benign cases, a single operator running many accounts from a narrow range of addresses they control. The same logic that groups legitimate free-tier usage together works just as well for spotting a fraud ring hiding behind superficially different account details.
The marketplace's team built a simple report: for any set of accounts flagged for suspicious activity for unrelated reasons, check whether their login IP addresses clustered unusually tightly on the same network ranges, using the ASN and organization data as a cross-check against addresses that merely happened to be geographically close but belonged to different, unrelated providers. A cluster of accounts sharing a narrow slice of address space on the same hosting provider's ASN was a very different and much stronger signal than a cluster that happened to share a country, which millions of unrelated legitimate accounts would too.
Confirmed clusters led to a coordinated suspension across the whole ring at once, rather than the previous pattern of banning one account and watching a nearly identical one appear a week later from an adjacent address, since removing accounts one at a time from a ring operating across a shared range had let operators simply spin up a replacement, register from the address next door, and continue.
The team was careful not to over-rely on network proximity alone, since plenty of legitimate activity genuinely shares network ranges, a large office, a university, or a mobile carrier's shared address pool can put many unrelated legitimate users behind addresses that look clustered by this same measure. Network clustering was used as one signal that raised a case's priority for human review, not as an automatic ban trigger on its own.
Investigation volume was small relative to total marketplace traffic, since it only ran against accounts already flagged for other reasons rather than every login, which kept it well inside the free daily allowance included with the marketplace's key. Documentation for the fields involved is at /docs/ipv4-lookup/ and /docs/ipv6-lookup/, with rate limit behavior at /docs/rate-limits/.