Agentic Commerce Fraud: How IP Intelligence Stops AI Shopping Bot Abuse

// AI agent verification for e-commerce
async function verifyShoppingAgent(request: AgentRequest): Promise<AgentDecision> {
  const clientIP = request.headers['x-forwarded-for'] || request.ip;
  const agentIdentifier = request.headers['x-ai-agent'];

  // Fast IP lookup (35ms average)
  const ipData = await ipInfoClient.lookup(clientIP, {
    fields: ['security', 'connection', 'location', 'asn']
  });

  // Known AI shopping agent providers
  const authorizedProviders = {
    'openai-chatgpt': ['AS20473 (OpenAI)', 'AS14061 (Azure OpenAI)'],
    'google-gemini': ['AS396982 (Google Cloud)', 'AS15169 (Google)'],
    'anthropic-claude': ['AS14618 (AWS)', 'AS396982 (Google Cloud)'],
    'amazon-rufus': ['AS16509 (Amazon AWS)']
  };

  // Verify agent claims match IP origin
  if (agentIdentifier && authorizedProviders[agentIdentifier]) {
    const providerASNs = authorizedProviders[agentIdentifier];
    const ipASN = `AS${ipData.asn.asn} (${ipData.asn.name})`;

    if (providerASNs.some(asn => ipASN.includes(asn.split(' ')[0]))) {
      return { action: 'allow', reason: 'verified_ai_provider', confidence: 0.95 };
    }

    // Agent claims to be from provider but IP doesn't match
    return {
      action: 'challenge',
      reason: 'agent_identity_mismatch',
      riskScore: 0.78,
      requiresUserConfirmation: true
    };
  }

  // Unknown agent - apply standard fraud checks
  return evaluateUnknownAgent(ipData, request);
}

// Behavioral analysis for AI shopping agents
interface AgentShoppingProfile {
  avgOrderValue: number;
  categoriesPurchased: Set<string>;
  typicalShoppingHours: number[];
  geographicHistory: Set<string>;
  returnRate: number;
  avgSessionDuration: number;
}

async function analyzeAgentBehavior(
  agentId: string,
  ipData: IPIntelligence,
  purchaseRequest: PurchaseRequest
): Promise<BehaviorScore> {
  const profile = await getAgentProfile(agentId);

  // Geographic anomaly detection
  const previousCountries = Array.from(profile.geographicHistory);
  const currentCountry = ipData.country;

  if (previousCountries.length > 0 && !previousCountries.includes(currentCountry)) {
    // Agent shopping from new country
    const lastShopTime = await getLastAgentActivity(agentId);
    const timeDiff = Date.now() - lastShopTime;

    // Impossible travel: different continent within 2 hours
    const lastContinent = await getContinent(previousCountries[0]);
    const currentContinent = await getContinent(currentCountry);

    if (lastContinent !== currentContinent && timeDiff < 7200000) {
      return {
        score: 0.91,
        flags: ['impossible_travel', 'agent_hijacking_suspected'],
        recommendation: 'require_reauth'
      };
    }
  }

  // Sudden spending pattern change
  if (purchaseRequest.amount > profile.avgOrderValue * 5) {
    return {
      score: 0.82,
      flags: ['unusual_order_value', 'potential_compromise'],
      recommendation: 'user_confirmation_required'
    };
  }

  // Proxy/VPN with high-value purchase
  if ((ipData.security.isVpn || ipData.security.isProxy) && purchaseRequest.amount > 500) {
    return {
      score: 0.76,
      flags: ['anonymous_high_value', 'vpn_detected'],
      recommendation: 'step_up_auth'
    };
  }

  return { score: 0.15, flags: [], recommendation: 'allow' };
}

// Coordinated agent attack detection
interface AgentNetworkPattern {
  ipRange: string;
  asn: number;
  agentCount: number;
  sharedPatterns: string[];
  firstSeen: Date;
  riskIndicators: string[];
}

async function detectCoordinatedAgentAttack(
  ipData: IPIntelligence,
  request: AgentRequest
): Promise<AttackAssessment> {
  // Check for agent clustering from same ASN
  const recentAgentsFromASN = await getRecentAgentsFromASN(ipData.asn.asn, {
    window: '1h',
    minCount: 10
  });

  if (recentAgentsFromASN.length >= 50) {
    // High agent density from single ASN
    const uniqueUsers = new Set(recentAgentsFromASN.map(a => a.userId));
    const agentsPerUser = recentAgentsFromASN.length / Math.max(uniqueUsers.size, 1);

    if (agentsPerUser > 5) {
      return {
        isCoordinatedAttack: true,
        attackType: 'agent_swarm',
        confidence: 0.89,
        recommendation: 'rate_limit_asn',
        metadata: {
          agentCount: recentAgentsFromASN.length,
          uniqueUsers: uniqueUsers.size,
          asn: ipData.asn.asn,
          asnName: ipData.asn.name
        }
      };
    }
  }

  // Detect synchronized purchasing patterns
  const synchronizedPurchases = await detectSynchronizedPatterns(ipData, {
    timeWindow: '5m',
    similarityThreshold: 0.85
  });

  if (synchronizedPurchases.detected) {
    return {
      isCoordinatedAttack: true,
      attackType: 'synchronized_fraud',
      confidence: 0.92,
      recommendation: 'block_pending_review',
      metadata: synchronizedPurchases.details
    };
  }

  return { isCoordinatedAttack: false, confidence: 0 };
}