--- title: Introducing IP Intelligence to control unwanted traffic description: Ngrok launched IP Intelligence, a new feature available to all Traffic Policy users that tags every incoming IP address with autonomous system information, IP... canonical: https://daily.dev/posts/introducing-ip-intelligence-to-control-unwanted-traffic-cnfreadba twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Introducing IP Intelligence to control unwanted traffic | daily.dev og:description: Ngrok launched IP Intelligence, a new feature available to all Traffic Policy users that tags every incoming IP address with autonomous system information, IP... og:url: https://daily.dev/posts/introducing-ip-intelligence-to-control-unwanted-traffic-cnfreadba og:image: https://api.daily.dev/og/posts/CNFREadbA.png og:image:alt: Introducing IP Intelligence to control unwanted traffic og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Introducing IP Intelligence to control unwanted traffic **[ngrok Blog](https://daily.dev/sources/ngrok)** · 7 min read · 0 upvotes · 0 comments ## Summary Ngrok launched IP Intelligence, a new feature available to all Traffic Policy users that tags every incoming IP address with autonomous system information, IP categories (blocklists, known services like Datadog or Censys), and geolocation data. Developers can use these variables to block Tor exit nodes, allow only known IP ranges (e.g., AWS SNS), block scrapers, or restrict access by country, all without maintaining their own allow/denylists. Ngrok also shared how it used the feature to mitigate a DDoS attack on its own homepage that saw a 93,000% traffic spike, identifying the surge as coming from proxy and datacenter IPs rather than typical residential traffic. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I block Tor exit node traffic at my ngrok endpoint? Ngrok's IP Intelligence feature lets you block Tor exit node traffic by adding a Traffic Policy rule that checks the client IP's category for Tor. Ngrok automatically maintains and updates the list of current Tor exit node IP addresses, since the network's node list constantly changes, so the block stays accurate without manual list maintenance. _Developers hardening API gateways against anonymized traffic can track tooling updates like this on daily.dev._ ### What data does ngrok's IP Intelligence feature expose for each request? IP Intelligence exposes three categories of data for every client IP hitting a ngrok endpoint: autonomous system information (ASN and organization, via conn.client_ip.as.number and conn.client_ip.as.organization), IP categories (tags identifying ownership or blocklist status, via conn.client_ip.categories), and geolocation data (both actual and registered location). It's available to all Traffic Policy users. _Teams evaluating API gateway security options can follow feature rollouts like this on daily.dev._ ### How did ngrok mitigate a DDoS attack using its own IP Intelligence feature? Ngrok mitigated a DDoS attack on ngrok.com, which saw a 93,000% spike in requests at its peak, by using IP Intelligence to identify that most attack traffic originated from known proxy and datacenter IPs rather than typical residential ISPs. They then adjusted Traffic Policy rules to reroute or block that traffic category, offloading load from the main site. _Engineers building DDoS defenses can follow real-world mitigation approaches like this on daily.dev._ ## Similar posts on daily.dev - [One IP address, many users: detecting CGNAT to reduce collateral effects](https://daily.dev/posts/one-ip-address-many-users-detecting-cgnat-to-reduce-collateral-effects-feiedp7f2) · Cloudflare · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#devtools](https://daily.dev/tags/devtools), [#api-gateway](https://daily.dev/tags/api-gateway) [View this post on daily.dev](https://daily.dev/posts/introducing-ip-intelligence-to-control-unwanted-traffic-cnfreadba) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Introducing IP Intelligence to control unwanted traffic","url":"https://daily.dev/posts/introducing-ip-intelligence-to-control-unwanted-traffic-cnfreadba","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/introducing-ip-intelligence-to-control-unwanted-traffic-cnfreadba"},"datePublished":"2026-08-23T07:21:18.607Z","dateModified":"2026-08-23T07:25:03.979Z","description":"Ngrok launched IP Intelligence, a new feature available to all Traffic Policy users that tags every incoming IP address with autonomous system information, IP...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d5746f88deeabad99db94e0d36bbacc8?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d5746f88deeabad99db94e0d36bbacc8?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"ngrok Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ngrok Blog","logo":"https://media.daily.dev/image/upload/s--718XXxvE--/f_auto,q_auto/v1787469610/logos/ngrok?_a=BAMAMicg0","url":"https://daily.dev/sources/ngrok"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/introducing-ip-intelligence-to-control-unwanted-traffic-cnfreadba","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,devtools,api-gateway","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ngrok Blog","item":"https://daily.dev/sources/ngrok"},{"@type":"ListItem","position":3,"name":"Introducing IP Intelligence to control unwanted traffic"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/introducing-ip-intelligence-to-control-unwanted-traffic-cnfreadba#faq","mainEntity":[{"@type":"Question","name":"How do I block Tor exit node traffic at my ngrok endpoint?","acceptedAnswer":{"@type":"Answer","text":"Ngrok's IP Intelligence feature lets you block Tor exit node traffic by adding a Traffic Policy rule that checks the client IP's category for Tor. Ngrok automatically maintains and updates the list of current Tor exit node IP addresses, since the network's node list constantly changes, so the block stays accurate without manual list maintenance. Developers hardening API gateways against anonymized traffic can track tooling updates like this on daily.dev."}},{"@type":"Question","name":"What data does ngrok's IP Intelligence feature expose for each request?","acceptedAnswer":{"@type":"Answer","text":"IP Intelligence exposes three categories of data for every client IP hitting a ngrok endpoint: autonomous system information (ASN and organization, via conn.client_ip.as.number and conn.client_ip.as.organization), IP categories (tags identifying ownership or blocklist status, via conn.client_ip.categories), and geolocation data (both actual and registered location). It's available to all Traffic Policy users. Teams evaluating API gateway security options can follow feature rollouts like this on daily.dev."}},{"@type":"Question","name":"How did ngrok mitigate a DDoS attack using its own IP Intelligence feature?","acceptedAnswer":{"@type":"Answer","text":"Ngrok mitigated a DDoS attack on ngrok.com, which saw a 93,000% spike in requests at its peak, by using IP Intelligence to identify that most attack traffic originated from known proxy and datacenter IPs rather than typical residential ISPs. They then adjusted Traffic Policy rules to reroute or block that traffic category, offloading load from the main site. Engineers building DDoS defenses can follow real-world mitigation approaches like this on daily.dev."}}]} ```