Add IP reputation scoring and geo-based restrictions

[PeaStew]

Summary

No IP-based abuse detection exists. The system cannot identify requests from known proxy/VPN ranges, bot infrastructure, or geographically impossible patterns.

Recommendation

IP Reputation

Integrate an IP reputation service to score incoming requests:

• MaxMind GeoIP2 — geo lookup + anonymous proxy detection
• IPQualityScore — fraud scoring, bot detection, VPN/proxy/Tor detection
• AbuseIPDB — community-reported malicious IPs

Implementation

Add middleware that:

1. Looks up IP reputation on first request (cache result for 1 hour)
2. Assigns a risk modifier to the session
3. High-risk IPs get additional friction (CAPTCHA, stricter rate limits)
4. Known bot infrastructure IPs get blocked

Geo Restrictions (Optional)

• If the game is region-specific, restrict signups to expected regions
• Flag accounts that suddenly appear from unexpected regions
• Feed geo data into the anomaly detection scoring system (see Add behavioral anomaly detection and velocity checks #24)