IP monitoring

IP monitoring is the process of recording, analysing, and using the IP addresses from which users access a service. It helps detect unusual or suspicious activity, such as logins from unexpected locations, rapid access from distant places, or connections from high-risk networks.

For financial and crypto services, IP monitoring is a core part of security and fraud prevention. It works alongside device binding, risk scoring, and behavioural analysis to protect accounts from unauthorised access and abuse.

What an IP address reveals

An IP (Internet Protocol) address is a numeric label assigned to each device connected to a network. It provides contextual information, though not exact personal details.

Geographic information

• Approximate location at the level of country, region, and sometimes city.
• Time zone and typical language associated with that region.
• Whether the IP is associated with a residential, business, data centre, or hosting network.

Network characteristics

• Internet Service Provider (ISP) or hosting provider.
• Whether the IP is known to be associated with:
  • Proxies, VPNs, or Tor exit nodes.
  • Data centres or cloud providers (often higher risk for consumer accounts).
  • Known bad actors, botnets, or abuse networks.

Behavioural context

• Typical locations from which a user accesses the service.
• Whether a login comes from a usual or unusual location for that user.
• Whether multiple accounts are being accessed from the same IP (possible fraud ring or shared device).

IP addresses do not directly reveal your exact home address or identity, but they provide important signals for risk assessment.

How IP monitoring works

IP monitoring typically involves several steps.

1. IP capture

Each time you interact with the service, your IP address is recorded, such as when you:

• Log in or log out.
• Perform a transaction (deposit, withdrawal, transfer, trade).
• Change security settings (password, 2FA, recovery email).
• Access sensitive features (API keys, external addresses, high-value actions).

The IP is captured server-side from the incoming request.

2. Enrichment and risk scoring

The raw IP is enriched with additional data from internal and external sources:

• Geolocation databases that map IPs to countries, regions, and cities.
• Threat intelligence feeds that flag IPs associated with:
  • Known fraud, abuse, or attacks.
  • Proxies, VPNs, anonymisers, or Tor.
  • Data centres or hosting providers.
• Historical data about how that IP has been used on the platform (for example, linked to multiple accounts, prior fraud cases).

This enriched data contributes to a risk score for the session, login, or transaction.

3. Pattern analysis

The service analyses IP patterns over time, such as:

• Usual locations – countries or regions from which you typically access the service.
• Impossible travel – logins from two geographically distant locations within a time window that makes physical travel impossible (for example, London and Sydney within an hour).
• New or unusual locations – first-time logins from a country or region you have never used before.
• Shared IPs – multiple accounts accessing the service from the same IP, which may indicate fraud rings, shared devices, or corporate networks.

These patterns help distinguish normal behaviour from potentially suspicious activity.

4. Action and response

Based on the IP-related risk signals, the service may:

• Allow the action with no additional checks (low risk, familiar IP).
• Require additional authentication (for example, 2FA, OTP, or security questions) for medium risk.
• Block or hold the action for review if the risk is high (for example, known malicious IP, impossible travel combined with other red flags).
• Trigger alerts to the security or fraud team for investigation.
• Notify the user about the login or transaction (for example, “We noticed a login from a new location”).

Common use cases for IP monitoring

IP monitoring is used in several key scenarios.

Login security

• Detecting logins from new or unusual countries or regions.
• Identifying impossible travel patterns that suggest account takeover.
• Flagging logins from high-risk IPs (for example, known proxies, data centres, or abuse networks).
• Requiring additional verification when the IP risk is elevated.

Transaction monitoring

• Assessing the risk of deposits, withdrawals, and transfers based on the IP location.
• Detecting patterns such as:
  • Rapid transactions from multiple geographic locations.
  • Withdrawals initiated from IPs different from the usual login location.
  • Multiple accounts initiating similar transactions from the same IP.
• Applying stricter controls or manual review for high-risk IP patterns.

Fraud and abuse prevention

• Identifying potential fraud rings operating from shared IPs or data centres.
• Detecting automated attacks, credential stuffing, or bot activity from suspicious IP ranges.
• Correlating IP data with other signals (device fingerprints, behaviour) to build a fuller risk picture.

Compliance and investigations

• Maintaining logs of IP addresses for security incidents and regulatory requirements.
• Supporting investigations into unauthorised access, fraud, or money laundering.
• Providing evidence of where and how certain actions were performed (in combination with other data).

How IP monitoring affects users

From a user’s perspective, IP monitoring may be visible in several ways.

Login from a new location

• You travel or move to a new city or country and try to log in.
• The service detects a new IP location and may:
  • Allow login but send a notification (email, push, or SMS) about the new location.
  • Require additional verification (for example, 2FA or a security check).
• This is normal and intended to protect your account.

Impossible travel detection

• You log in from one location, and shortly afterwards there is a login attempt from a distant location.
• The service may:
  • Block the second login as suspicious.
  • Freeze or restrict the account until you confirm activity.
  • Notify you of the suspicious attempt.
• This helps stop attackers who have obtained your credentials but are in a different location.

Use of VPNs, proxies, or Tor

• If you connect via a VPN, proxy, or Tor:
  • Your visible IP may appear to come from a different country or from a data centre.
  • The service may treat this as higher risk and require additional verification.
  • In some cases, certain features may be restricted or unavailable from such IPs.
• This is not a ban on VPNs, but a risk control to prevent abuse.

Shared or corporate networks

• On shared networks (for example, universities, co-working spaces, large companies):
  • Many users may appear to come from the same IP or IP range.
  • The service may rely more on device and behavioural signals in addition to IP.
  • You generally will not notice any difference unless there is suspicious activity linked to that network.

Privacy and data protection

IP monitoring must be implemented with privacy and security in mind.

Data minimisation

• Only necessary IP-related data should be collected and retained.
• Retention periods should be defined and aligned with legal and regulatory requirements.
• Access to IP logs should be restricted to authorised personnel and systems.

Transparency

• Users should be informed (for example, in privacy policies and security documentation) that IP addresses are collected and used for security and fraud prevention.
• Clear explanations help build trust and meet regulatory expectations.

Security of logs

• IP logs and related security data must be protected against unauthorised access, tampering, and breaches.
• Encryption, access controls, and monitoring are essential to protect this sensitive information.

Good practices for users

To reduce friction and stay secure with IP monitoring:

• Expect additional checks when logging in from new or unusual locations, especially when traveling.
• If you use a VPN, be aware that it may trigger additional security steps; consider disconnecting it for sensitive actions if possible.
• Keep your contact details (email, phone) up to date so you receive location-based alerts promptly.
• If you receive an alert about a login or transaction you do not recognise, treat it as a potential security incident and follow the service’s guidance immediately.
• Avoid using public or shared computers for sensitive actions; if you must, always log out and be mindful of the network you are using.

Good practices for services

For platforms implementing IP monitoring:

• Combine IP data with other signals (device, behaviour, transaction patterns) rather than relying on IP alone.
• Calibrate risk rules to avoid excessive false positives (for example, for frequent travelers or users in border regions).
• Provide clear user communications when IP-based checks are triggered (for example, “We noticed a login from a new location”).
• Ensure IP logging and analysis comply with applicable privacy laws and regulations.
• Regularly update threat intelligence feeds and IP risk databases to reflect emerging threats.