ip.hosting_provider
The address is inside a published cloud-hosting-provider range (AWS, GCP, Oracle Cloud, DigitalOcean, or Azure).
What it looks at#
Looks up the address against a combined list of published IP ranges from AWS, Google
Cloud, Oracle Cloud, DigitalOcean, and Azure — the exact same files those providers
publish for their own customers to allowlist against. When it matches, the provider’s
name is also returned in data.hosting_provider.
Why it matters#
A real visitor’s browser rarely connects to a signup form from a cloud-provider IP directly — that address class is what a script, a bot, or a bulk automated signup runs from. It isn’t proof by itself (a corporate NAT or VPN endpoint can also live in cloud space), but it’s a meaningfully different population from ordinary residential and mobile traffic.
What to do#
Medium severity — worth weighing alongside other signals rather than blocking outright.
Combine with ip.tor_exit and (on /v1/emails or /v1/signups) the email-side checks
before deciding whether to challenge or reject.