Simple heuristics: proxy/hosting flags from the IP geolocation API, known cloud ASNs, and ISP/hosting indicators raise suspicion. This is a heuristic only — not a guarantee.
No external threat services are called — everything is computed locally from the geolocation response.