Satellite users move fast. That's not fraud.

The false positive it fixes

Satellite routing sends traffic through gateways that can be far from the subscriber, and the egress can shift between requests. Distance-over-time ("impossible travel") and geo-mismatch rules read that as a hijacked session. The signal you need isn't "this looks far" — it's "this is a satellite link, so distance jumps are expected."

When connection_type reads satellite, the score is capped at 20 and benign_network_kind lands in reasons[]. You can relax the velocity check for that one case while keeping it strict everywhere else.

In your code

const res = await fetch("https://api.geoq.io/v1/check?ip=98.97.0.1", {
  headers: { "x-api-key": process.env.GEOQ_KEY },
});
const { signals, risk } = await res.json();

// Starlink user — apparent location jumps are normal, not takeover.
if (signals.connection_type === "satellite") {
  relaxImpossibleTravelCheck(); // benign velocity, score already capped at 20
}

Honest about ASN ambiguity

A satellite operator's ASN can announce more than subscriber access — uplinks, corporate ranges, infrastructure. We classify an IP as satellite only for ranges we can attribute to satellite access; everything we can't attribute is connection_type === "unknown", never a fabricated satellite or datacenter value. That keeps the benign-velocity reducer from firing where it shouldn't.

What sets the value