Furqan Ashraf

I'd stick with Decimal like you did. Minor units make sense once you're storing or charging money, but a rate needs a lot more precision than cents, so for a converter Decimal keeps things simpler. One thing I noticed in RateStore: the one-hour check is based on when the phone fetched the table, not when the rates were published. If your provider only updates once a day, the app could say "updated 2 minutes ago" while showing yesterday's rates. Most APIs send a date with the response, so I'd show that instead. Also, if the app calls the provider directly, the API key ends up inside the app and every install eats into your quota. A small proxy that fetches once an hour and caches it for everyone avoids both. Full disclosure, I work on CurrencyFreaks, so take this with that in mind. It returns rates as strings, so your string-to-Decimal parsing works without changes, and USD is the default base, which matches your RateTable. The free plan only updates once a day though (1,000 calls a month), so your hourly refresh would only make sense on the $9.99 plan, which updates hourly. Docs if you want to compare: https://currencyfreaks.com/documentation If daily rates are fine for you, Frankfurter is free and doesn't need a key, so that's an easy option too.

For per-use cost, the layer I'd add sits between your device signature and the global cap: what kind of network the request comes from. Part of it is free on Workers already. request.cf.asn and request.cf.asOrganization tell you when a "visitor" is a cloud provider, and those guests could get zero free generations instead of the normal allowance. That catches the lazy scripts at no cost. It won't catch residential proxies or VPNs, which is how someone walks around per-IP limits. That needs an IP reputation lookup, called only on the generate path. We sell one (disclosure: I work at IPGeolocation.io). It's a paid feature and it means sending the IP to a third party, which you'd want in your privacy note, so it only makes sense once abuse costs you more than the plan: https://ipgeolocation.io/ip-security-api.html On Praneet's question, I'm curious too: when the global cap hits mid-day, do new visitors get "come back tomorrow" or a nudge to sign up?

"The domain is the ID" holds, with one wrinkle worth spelling out: for the 30 to 40% of cases on *.onmicrosoft.com, there's nothing to look up. No registration date, no registrar, just a tenant name. Those are where the allow-listing fix does the work. The other half, the paid .top and .com domains, are where registration data earns its keep. A "helpdesk365"-style name registered last week is about as loud a signal as you get. One low-effort way to catch them before they message anyone is to filter a newly registered domains list for words like helpdesk, itsupport or 365 and alert on hits. WhoisFreaks (I work on it) publishes a free daily list on GitHub. It's a partial 10k/day sample, so a hit is a real signal and a miss proves nothing.

"DMARC does not stop them" should be printed on every email admin's monitor. On actually doing the lookalike monitoring, since that's where teams tend to stall: dnstwist on a schedule against your own domain is a fine free start. Where it gets thin is homoglyph variants and brand-plus-keyword names like yourbrand-support, which are exactly what BEC crews use for executive impersonation. If you'd rather not run that yourself, WhoisFreaks Brand Monitoring scans new registrations twice a day for typos, homoglyphs, keyword combos and TLD swaps, and alerts by email or webhook. Disclosure: I work there. There's a one-brand trial on request. Either way, the output slots nicely into your week-two gateway review as the list behind "domains that look like your own."

The credit-cost point in the ScrapingBee section is worth checking when comparing these tools. I work on APIFreaks (apifreaks.com/api/web-scraper), and our scraper has a similar trade-off: a static request uses 4 credits, while turning on JavaScript rendering uses 40. For anyone testing the options here, I’d run the same few URLs in both modes and compare the fields returned alongside the credits used. Sometimes the data is already in the initial HTML, so you can save the browser rendering for pages that actually need it.

The "same device, same IP address" link is a strong signal, but it gets weaker when fraud rings rotate through residential proxies. Adding the IP type to the account-linking step helps: residential proxy, VPN, Tor or hosting. The ipgeolocation.io IP Security API (https://ipgeolocation.io/documentation/ip-security-api.html) returns those flags with provider names and last-seen dates, which can feed the cross-account layer you describe.

Good point that a dedicated IP doesn't promise fewer challenges. For readers wondering why: many sites score IPs by type, not just by reputation. A static IP in a cloud provider's range can still be labeled hosting or VPN. Tools like the ipgeolocation.io IP Security API ( https://ipgeolocation.io/ip-security-api.html ) return VPN, proxy, Tor and cloud flags with a threat score, which is the kind of signal sites use to decide whether to challenge a connection.

Great write-up. The "country from a dropdown" detail explains a lot of the geolocation mismatches people see. When registry data can't be trusted, looking at the ASN's classification and its upstreams is often more telling than the WHOIS country. The ipgeolocation.io ASN API (ipgeolocation.io/documentation/asn-api.html) returns classification, allocation date and peering/upstream info, and the Abuse Contact API (https://ipgeolocation.io/documentation/ip-abuse-contact-api.html) returns the registered abuse contacts for an IP. Neither fixes the white-labeling problem you describe, but they make the gaps easier to spot.

Your point about "unknown" outcomes and clear reason codes is fair. A score with no explanation is hard to dispute. One format that helps is when each flagged domain comes with its evidence: a confidence value, first and last seen dates, and how many infrastructure links tied it to a known threat. The WhoisFreaks feed schema (https//whoisfreaks.com/documentation/threat-intelligence-feed) is built that way, so a user can see why a domain was listed rather than only a number.

The advice to point codes at a domain you own is the key one. Quishing works because users can't see where a sticker leads. On the defense side, the landing domains behind malicious QR codes are usually new, so phishing domain feeds with first_seen dates catch many of them early (e.g. https://whoisfreaks.com/products/threat-intelligence-feed).