🛡️ Real-Time IP Quality Checking with Scamalytics
The rise of online fraud, account takeover attempts, and fake transactions makes protecting your web application's entry points crucial. A highly effective method to achieve this is by implementing real-time IP address quality checks. By integrating the Scamalytics API, you can instantly assess the risk associated with any incoming IP address, identifying potential fraudsters, VPN users, bots, or datacenter traffic before they interact with your services.
📊 Key Quality Metrics Displayed
The Scamalytics V3 API provides a comprehensive security report nested under the scamalytics object, as well as detailed information from various external_datasources. This data is then used to generate a simple, actionable report for the application administrator or security system:
1. Core Risk Assessment
- Fraud Score (0-100): This is the most important metric. A score near 100 indicates a very high probability of fraud (e.g., traffic from a known botnet), while a score near 0 indicates low risk.
- Risk Level: Categorized as Low, Medium, or High, based on the fraud score.
- External Blacklisted (Scamalytics): Indicates if the IP is flagged on Scamalytics' internal blacklist.
2. Connection and Proxy Details
These metrics are essential for filtering low-quality or fraudulent traffic:
- Datacenter/Hosting: Flags IPs originating from commercial hosting providers rather than residential ISPs. This is a common indicator of bot or automated abuse.
- VPN/Anonymizing Proxy: Identifies the use of anonymity tools, often used to obscure a fraudster's true location.
- Apple iCloud Private Relay: Detects traffic routed through Apple's privacy service.
- ISP/Organization & Geolocation: Confirms the geographical location (Country/City) and the Internet Service Provider.
3. External Blacklist Checks
The script integrates checks against major third-party security lists, adding another layer of validation:
- IPsum Blacklisted: Checks against a well-known list of malicious IP addresses.
- Spamhaus DROP Blacklisted: Flags IPs associated with spam operations, botnets, and other malicious activities.
