Verifying an address matches its stated postal code before checkout
A mismatched postal code and city on an order form looks like a small typo until it turns into a delivery sent to the wrong part of the country entirely.
Detecting VPN and proxy traffic on signup forms
Free trials get abused in a predictable way: the same person signs up over and over, using a different email each time and a VPN to make each signup look like it came from a fresh, unrelated location. A subscription service noticed its trial-to-paid conversion numbers looked worse than they should, and digging into the raw signup data found the actual problem: a meaningful share of trials were never intended to convert, because they were the same handful of people churning through the free period repeatedly.
The signal that gave this away was the IP address behind each signup. A call to /v1/ip returns country, region, city, coordinates, ASN and organization for a given address, and with mg_extras=1 or the X-MG-Extras header, it also returns threat and network detail, flagging addresses known to belong to VPN exit nodes, open proxies, or other anonymizing infrastructure. Ordinary customers signing up from home or office connections almost never trigger this. Someone cycling through a commercial VPN service to claim the same trial repeatedly does, every time.
The company did not block VPN signups outright, since plenty of legitimate customers use one for ordinary privacy reasons and blocking them outright would have cost real business. Instead, a signup flagged as coming from VPN or proxy infrastructure got a lighter version of the trial, still functional enough to evaluate the product but capped in a way that made repeat abuse far less worthwhile, while an unflagged signup got the full trial experience. That distinction alone removed most of the economic incentive behind the abuse pattern without touching the experience of a normal customer who happened to be running a VPN for unrelated reasons.
The team paired this with a second check: looking at how many trial signups shared the same network range within a short window, using the ASN and organization fields to group addresses that belonged to the same infrastructure even when the specific IP address differed each time, since My Geocode's own free tier counts usage per /24 network for IPv4 and per /48 for IPv6 for exactly this kind of reason, addresses close together on a network tend to belong together. A cluster of signups from the same narrow range in a short window was a much stronger signal than any single flagged address on its own.
This ran entirely server-side, on the signup request itself, with no browser script and nothing visible to the person signing up. It also ran cheaply. One lookup per signup kept the service well inside the free daily allowance included with its key for most months, with the usual prepaid option covering any spike around a marketing push that drove a surge of new signups, legitimate or otherwise.
The broader point holds past free trials: any offer that is valuable enough to be worth repeating, a referral bonus, a first-order discount, a limited free tier, attracts exactly this kind of abuse, and the IP address behind the signup is often the cheapest signal available to catch it before it costs anything real. Details on the extras field and both address families are at /docs/ipv4-lookup/ and /docs/ipv6-lookup/.