n8n Workflow Uses Threat Scores and Four Branches to Filter Signup Fraud

A tutorial published on DEV Community outlines a more reliable signup fraud detection workflow built in n8n, replacing simple VPN boolean checks with a 0–100 threat score system. The workflow uses a webhook, a single IP lookup node, an override check, and a Switch node with four output branches covering allow, review, friction, and block actions. Three common failure cases are highlighted: corporate gateways like Zscaler that share IPs across entire workforces, privacy relays such as iCloud Private Relay that do not trigger standard VPN flags, and residential proxies that may evade datacenter-only checks. The IP lookup returns 28 security fields, including proxy and VPN confidence scores, which allow more nuanced routing decisions than a single flag permits. Each security lookup costs 2 credits, meaning a 150,000-credit monthly plan can cover up to 75,000 scored signups, and the author estimates build time at under one hour.