Yes, it's IP blacklists AFAIK.

And for sites with a lot of traffic, you probably don't even need an external subscription, you can deduce the ranges yourself simply by checking for IP addresses that wind up having logged-in users from all over the world in a short time frame.

Pretty easy to do accurately with a short set of heuristics.

IP addresses are assigned in blocks, and these blocks are assigned to registered companies - Long story short you can roughly determine whether an IP address is from a datacenter or is "residential" without too much issue - All DigitalOcean droplets are given IP addresses within DO's range for example.

Basically if the IP is from a datacenter - it's likely a VPN.

Easy. How many users are logging in from the same IP address is a big clue.