Engineering blog

Write-ups of work actually done on this API — including the bugs we shipped, with the numbers. There is no tips-and-tricks content here; it is cheap to produce, which is why it convinces nobody.

·5 min read

We were reporting a university as a VPN

An audit of our ASN list against the regional registry found an entry labelled 'WindScribe' that was actually Wake Forest University. Here is how a comment became a false positive against real students.

Read
·6 min read

How to benchmark a fraud API, including your own

Most accuracy claims in this category are unfalsifiable. Two different standards — ground truth where it exists, reference consensus where it does not — and why false positives deserve their own column.

Read
·5 min read

The best VPN detection is asking the VPN

ASN lists and per-IP feeds both infer. NordVPN, Mullvad and Surfshark publish their exit nodes at public endpoints their own apps call — which is more authoritative than any heuristic can be.

Read