ip-cluster-analysis

name

ip-cluster-analysis

description

Detect coordinated free-tier AI abuse by analyzing IP address concentration in client telemetry. Use when investigating usage spikes, geographic anomalies in AI spend, or suspected fraud rings that bypass Verisoul (which only checks the first AI query). This skill queries the enriched client-events table to find IPs and /24 subnets with suspiciously many distinct free users creating AI blocks, then trends them over time to distinguish new fraud surges from persistent abuse.

IP Cluster Analysis

Detect fraud rings by finding IPs/subnets shared by many distinct free AI users.

Schema config

Table/project/database names are logical, resolved from config/schema.json (see SCHEMA.md). SQL uses placeholders like {{ tables.int_enriched_client_events }}. Run via api_client.py query --database warehouse --file <path> (or --sql) to resolve them automatically; substitute physical names yourself for raw curl/bq.

Data Source

{{ tables.int_enriched_client_events }} contains client telemetry enriched with:

• ip_address — client IP as seen by RudderStack (from context_request_ip)
• geo_country, geo_region, geo_city, geo_postal_code — geo derived from that IP
• user_plan_type — plan at time of event (free, pro, build, etc.)
• event_name — filter to agentmode.createdaiblock for AI usage

This table lives in the warehouse database (see config/schema.json).

IP address is available in server-side AI request tables (). The connection to AI spend is through — match users from IP clusters to their server-side costs.