Following from research in T354597: Record IP reputation data for account creations and edits, let's look at introducing a variable in AbuseFilter to allow actions based on whether an IP address for a request is in iPoid-Service's database, or more granular controls, like if an IP address belongs to a specific risk type (e.g. callback proxy vs VPN).

At a minimum, it seems that we would want to show a CAPTCHA or provide some type of mitigation when we see requests associated with IP addresses known to ipoid.