>1/ needs authenticationless way to search. all other ip look up tools don't require an account for me to test this. I'm not going to register.

Okay I will look into a solution.

2/ I've tried blocking vpn or proxy users (by ip hosting provider), but found too many false positives. Using a VPN is common for IT professionals or consumers trying to 'protect' their privacy and this impacted the growth of my app.

That good to know, I do not find that I have a lot of false postivies but I would imagine it all depends on audience.

>How is your tool better at detecting a bot vs a human using a vpn?

It does not know the difference as or right now. I was thinking about adding a user-agent validation as well which could add another layer.

> I was thinking about adding a user-agent validation as well which could add another layer.

Presumably this service exists because bots try to avoid detection. I don't think UA validation would really help much and there are plenty of libraries already that do this.

I didn't have issues per se with bots, but people trying to hide their location (think Nigerian user using a US-based VPN).

My trick was to get the device's timezone (which you don't need privacy permissions for on web or mobile). If it didn't match up with the ip address's country (or was in a banned country), then the account was banned.

That is a real good idea, I really like it.

Browser anti-fingerprinting tools may alter the timezone. Mine does.

My use-case is a mobile app. If you use those tools, you can't expect your web experience to be 'normal' :-/