Reading an IP Lookup Result: A Field Guide for Support Teams

Support agents are the people who actually read IP lookups all day, usually while a frustrated customer waits. This is the field guide we hand to them.

Start with connection type, not the score

The score is a summary. The connection type is the fact. Work in this order:

• Residential — a consumer ISP line. Almost always a real person, unless the address is a known residential proxy exit.
• Mobile — a carrier network behind large-scale NAT. Thousands of subscribers can share one address, so per-IP reasoning is weak here.
• Business — a corporate range. Shared by an office; expect many users, one address.
• Hosting / datacenter — a server, not a household. Something is relaying, scraping, or automating.

If a customer complains about a block and the type is residential, the block was probably a mistake in your rules. If it is hosting, ask what they are connecting through.

Then look at the organisation and ASN

The ASN tells you who runs the network. "AS13335 Cloudflare" behaves nothing like a small hosting reseller with a long abuse history, even though both are datacenter ranges. The org name is often enough to resolve a ticket in seconds: a corporate VPN gateway, a university, a well-known privacy provider.

Treat geolocation as an estimate

Country accuracy is high. City accuracy is not. IP geolocation is derived from registration data and network measurement, and a customer in one city can legitimately appear in another a hundred kilometres away — especially on mobile. Never tell a customer "our system says you are in X, so you are lying". Say the network routes through X.

Understand what the flags mean

• Proxy — traffic is being relayed. Could be a corporate gateway, could be abuse tooling.
• VPN — a commercial privacy service. Extremely common among ordinary, honest users.
• TOR — the address is on a published exit list. High anonymity intent, but also used by journalists and researchers.

A VPN flag on its own is not fraud. Millions of people run a VPN permanently because their browser or antivirus bundles one.

A workable escalation ladder

• Residential, low score, one failed check → almost certainly a false positive. Restore access.
• VPN or business, medium score → ask the customer to retry without the VPN, or verify by email.
• Hosting or TOR, high score, plus other signals (new account, mismatched billing country, rapid retries) → keep the restriction and escalate to the fraud queue.
• Any block affecting a long-standing paying account → override first, investigate after. The cost of the wrong call is not symmetric.

Write the reason down

When you resolve a ticket, log the verdict you saw and what you decided. Over a few weeks those notes become the best possible dataset for tuning thresholds: they are real cases, labelled by humans, from your own traffic. That is worth more than any generic recommended cut-off.