Bot Detection & Credential Stuffing Prevention with IP Intelligence

// Express/Next.js middleware for bot detection
import { LRUCache } from 'lru-cache';

const ipCache = new LRUCache<string, BotDecision>({
  max: 10000,
  ttl: 1000 * 60 * 5, // 5 minutes
});

export async function botDetectionMiddleware(
  req: Request,
  res: Response,
  next: NextFunction
) {
  const clientIP = getClientIP(req);
  const userAgent = req.headers['user-agent'];

  // Check cache first
  const cached = ipCache.get(clientIP);
  if (cached) {
    return handleDecision(cached, req, res, next);
  }

  // Parallel IP intelligence fetch
  const [geoData, securityData, reputation] = await Promise.all([
    ipInfoClient.geolocation(clientIP),
    ipInfoClient.security(clientIP),
    reputationService.score(clientIP)
  ]);

  // Layer 1: Hard block (known bad actors)
  if (reputation.score < 30) {
    const decision: BotDecision = {
      action: 'block',
      reason: 'known_malicious_ip',
      ttl: 3600
    };
    ipCache.set(clientIP, decision);
    return handleDecision(decision, req, res, next);
  }

  // Layer 2: Infrastructure filtering
  if (securityData.is_hosting || securityData.is_tor) {
    // For sensitive endpoints, block; others challenge
    const isSensitiveEndpoint =
      req.path.includes('/login') ||
      req.path.includes('/api/auth');

    const decision: BotDecision = isSensitiveEndpoint ? {
      action: 'block',
      reason: 'hosting_infrastructure',
      ttl: 1800
    } : {
      action: 'challenge',
      reason: 'suspicious_infrastructure',
      ttl: 900
    };
    ipCache.set(clientIP, decision);
    return handleDecision(decision, req, res, next);
  }

  // Layer 3: Behavioral analysis (for tracked IPs)
  const ipHistory = await requestHistory.get(clientIP);
  if (ipHistory && ipHistory.length > 10) {
    const behavior = analyzeBehavior(ipHistory);
    if (behavior.isAutomated && behavior.confidence > 0.7) {
      const decision: BotDecision = {
        action: 'block',
        reason: 'automated_behavior_pattern',
        ttl: 3600
      };
      ipCache.set(clientIP, decision);
      return handleDecision(decision, req, res, next);
    }
  }

  // Layer 4: Rate limiting by IP
  const rateLimitStatus = await rateLimiter.check(clientIP);
  if (!rateLimitStatus.allowed) {
    const decision: BotDecision = {
      action: 'challenge',
      reason: 'rate_limit_exceeded',
      ttl: 600
    };
    ipCache.set(clientIP, decision);
    return handleDecision(decision, req, res, next);
  }

  // Passed all checks
  const decision: BotDecision = {
    action: 'allow',
    reason: 'all_checks_passed',
    ttl: 300
  };
  ipCache.set(clientIP, decision);
  return handleDecision(decision, req, res, next);
}

function handleDecision(
  decision: BotDecision,
  req: Request,
  res: Response,
  next: NextFunction
) {
  switch (decision.action) {
    case 'block':
      res.status(403).json({
        error: 'Access denied',
        message: 'Your request has been blocked.'
      });
      return;

    case 'challenge':
      // Redirect to CAPTCHA or JavaScript challenge
      res.redirect('/challenge?token=' + generateChallengeToken());
      return;

    case 'allow':
      // Track request for behavioral analysis
      requestHistory.track(getClientIP(req), {
        path: req.path,
        method: req.method,
        userAgent: req.headers['user-agent'],
        timestamp: Date.now()
      });
      next();
      return;
  }
}

// Credential stuffing detection service
class CredentialStuffingDetector {
  private redis: Redis;
  private ipInfo: IPInfoClient;

  async checkLoginAttempt(
    username: string,
    password: string, // hashed
    ipAddress: string,
    userAgent: string
  ): Promise<LoginDecision> {
    const [ipData, failedAttempts] = await Promise.all([
      this.ipInfo.security(ipAddress),
      this.getRecentFailedLogins(ipAddress, 3600)
    ]);

    const riskFactors: RiskFactor[] = [];

    // Check 1: Multiple failed attempts from this IP
    const uniqueAccounts = new Set(
      failedAttempts.map(a => a.username)
    ).size;

    if (uniqueAccounts >= 5) {
      riskFactors.push({
        factor: 'multiple_account_attempts',
        weight: 0.8,
        description: `IP attempted logins to ${uniqueAccounts} accounts`
      });
    }

    // Check 2: Proxy/VPN usage
    if (ipData.is_proxy || ipData.is_vpn) {
      riskFactors.push({
        factor: 'proxy_infrastructure',
        weight: ipData.is_tor ? 0.9 : 0.5,
        description: 'Login from anonymous proxy network'
      });
    }

    // Check 3: Datacenter/hosting IP
    if (ipData.is_hosting) {
      riskFactors.push({
        factor: 'hosting_infrastructure',
        weight: 0.7,
        description: 'Login from datacenter IP'
      });
    }

    // Check 4: Geographic velocity (if user has history)
    const userHistory = await this.getUserLocationHistory(username);
    if (userHistory.lastLocation) {
      const velocity = this.calculateVelocity(
        userHistory.lastLocation,
        ipData.coordinates,
        userHistory.lastLoginTime
      );

      if (velocity > 900) { // Faster than commercial flight
        riskFactors.push({
          factor: 'impossible_travel',
          weight: 0.95,
          description: 'Impossible travel velocity detected'
        });
      }
    }

    // Calculate aggregate risk
    const totalRisk = riskFactors.reduce(
      (sum, factor) => Math.max(sum, factor.weight),
      0
    );

    // Make decision
    if (totalRisk >= 0.8) {
      return {
        allowed: false,
        reason: 'high_risk_credential_stuffing',
        requireMFA: false,
        blockIP: true,
        riskFactors
      };
    }

    if (totalRisk >= 0.5) {
      return {
        allowed: true,
        reason: 'medium_risk_require_verification',
        requireMFA: true,
        blockIP: false,
        riskFactors
      };
    }

    return {
      allowed: true,
      reason: 'normal_login',
      requireMFA: false,
      blockIP: false,
      riskFactors: []
    };
  }

  private async getRecentFailedLogins(
    ip: string,
    seconds: number
  ): Promise<FailedLogin[]> {
    const key = `failed_logins:${ip}`;
    const attempts = await this.redis.zrangebyscore(
      key,
      Date.now() - (seconds * 1000),
      Date.now()
    );
    return attempts.map(JSON.parse);
  }

  private calculateVelocity(
    from: Coordinates,
    to: Coordinates,
    timestampMs: number
  ): number {
    const distance = haversine(from, to); // km
    const hours = (Date.now() - timestampMs) / 3600000;
    return distance / hours; // km/h
  }
}