IP Intelligence for Login Risk

A correct password proves that whoever is logging in has the password, not that they are the account owner. Credential stuffing and account takeover both arrive with valid credentials. What distinguishes them from the owner is context, and the IP address is the context you get for free on every request: where the connection appears to come from, which network it belongs to, whether that network is a consumer ISP or a rented server, and how the address has behaved elsewhere.

Compare the login to the account's own history first. A country or an autonomous system the account has never used before is the most useful single anomaly, because it is specific to that user. Then read the network type: hosting and datacenter ranges are where automated attacks run from and where few real customers sign in. Proxy, VPN and Tor flags indicate that the visible address is a relay. Presence on abuse blocklists or recent abuse reports adds weight.

Then look across accounts. One address or one /24 range attempting many different usernames, especially with a high failure rate, is credential stuffing regardless of what any single attempt looks like. Impossible travel, two logins from places too far apart for the time between them, is strong when both addresses are residential and weak when one is a VPN or a mobile gateway.

Allow logins whose signals match the account's history. Step up when something is new but not alarming: a new country on a residential ISP, a VPN flag, a first login from a new device. A second factor, a confirmation email or a push notification resolves most of these with little friction. Block and notify only when the evidence stacks: a hosting range plus a blocklist hit plus a pattern of attempts across accounts, or a login that follows a credential-stuffing burst from the same network. Every block should generate a message to the account owner, because a false positive that the user can clear quickly is a minor annoyance and a silent one is a support ticket.

Travellers change country. Carrier-grade NAT means a single mobile address can carry hundreds of unrelated users, one of whom may be attacking you. Corporate VPNs put an entire company behind a hosting range. IPv6 privacy extensions rotate a device's address daily. None of these is an attack, and a system that treats them as one trains users to expect lockouts. Weight IP signals against device recognition, typing and navigation behaviour, and the account's value, and let remembered devices bypass step-up for low-risk changes.

Record the address, ASN, network type, reputation signals and the decision for every login attempt, successful or not. Review blocks and step-ups weekly for patterns you did not anticipate, and feed confirmed takeovers back into the thresholds. The goal is a system that gets quieter and more accurate over time, not one that blocks more.