How APIs Can Block Suspicious Web Visitors Based on IP Address

We don't want to allow signups from VPNs or proxies. Visitors could be using a VPN to mask their real location and bypass location restrictions. A visitor using TOR, which hides their real location and identity, might be trying to perform malicious activity on your site. So how can we block these users?