Promotion Abuse Prevention: How IP Intelligence Stops Multi-Account Fraud

// Multi-account detection via IP analysis
async function detectLinkedAccounts(
  newAccount: AccountRequest,
  ipData: IPIntelligence
): Promise<LinkageResult> {
  // Get IP lookup with connection and security data
  const ipLookup = await ipInfoClient.lookup(ipData.ip, {
    fields: ['security', 'connection', 'asn']
  });

  // Check for existing accounts from this IP
  const existingAccounts = await getAccountsByIP(ipData.ip, {
    lookbackDays: 90,
    includePromoUsage: true
  });

  if (existingAccounts.length >= 3) {
    // Multiple accounts from same IP
    const promoAbuseScore = calculatePromoAbuseScore(existingAccounts);

    return {
      isLinked: true,
      linkageType: 'same_ip',
      confidence: 0.85 + (existingAccounts.length * 0.02),
      existingAccountCount: existingAccounts.length,
      totalPromoValueClaimed: sumPromoValue(existingAccounts),
      recommendation: promoAbuseScore > 0.7 ? 'block_promo' : 'flag_review'
    };
  }

  // Check for accounts from same IP range (subnet)
  const subnetAccounts = await getAccountsBySubnet(ipData.ip, {
    subnet: '/24', // 256 IPs
    lookbackDays: 30
  });

  if (subnetAccounts.totalAccounts >= 10 && subnetAccounts.promoClaimRate > 0.4) {
    return {
      isLinked: true,
      linkageType: 'subnet_cluster',
      confidence: 0.78,
      clusterSize: subnetAccounts.totalAccounts,
      recommendation: 'enhanced_verification'
    };
  }

  return { isLinked: false, confidence: 0.12 };
}

// Proxy-based account creation detection
async function assessProxyRisk(ipData: IPIntelligence): Promise<ProxyRiskScore> {
  const securityFlags = [];

  // VPN detection
  if (ipData.security.isVpn) {
    securityFlags.push({
      type: 'vpn',
      severity: 'medium',
      provider: ipData.security.vpnProvider || 'unknown'
    });
  }

  // Proxy detection (datacenter)
  if (ipData.security.isProxy && ipData.connection.type === 'hosting') {
    securityFlags.push({
      type: 'datacenter_proxy',
      severity: 'high',
      datacenter: ipData.connection.isp
    });
  }

  // Residential proxy detection
  if (ipData.security.isProxy && ipData.connection.type === 'residential') {
    // Residential proxies are harder to detect but more suspicious
    securityFlags.push({
      type: 'residential_proxy',
      severity: 'critical',
      indicators: ['residential_with_proxy_flags', 'isp_mismatch']
    });
  }

  // Tor exit node
  if (ipData.security.isTor) {
    securityFlags.push({
      type: 'tor_exit_node',
      severity: 'critical',
      recommendation: 'block_promo'
    });
  }

  // Calculate composite risk score
  const maxSeverity = Math.max(
    ...securityFlags.map(f => ({ low: 0.3, medium: 0.5, high: 0.75, critical: 0.95 }[f.severity] || 0))
  );

  return {
    score: maxSeverity,
    flags: securityFlags,
    recommendation: maxSeverity > 0.7 ? 'block_promo' : maxSeverity > 0.5 ? 'flag_review' : 'allow'
  };
}

// Coordinated abuse pattern detection
interface AbusePattern {
  patternId: string;
  patternType: 'signup_burst' | 'referral_chain' | 'coupon_cluster' | 'loyalty_farming';
  accountsInvolved: string[];
  promoValueAtRisk: number;
  detectionConfidence: number;
}

async function detectCoordinatedAbuse(
  accountId: string,
  ipData: IPIntelligence,
  promoRequest: PromotionRequest
): Promise<AbusePattern[]> {
  const patterns: AbusePattern[] = [];

  // Detect signup bursts from related IPs
  const recentSignups = await getRecentSignupsFromASN(ipData.asn.asn, {
    window: '24h',
    minCount: 5
  });

  if (recentSignups.length >= 20) {
    // High signup volume from single ASN
    const promoClaimRate = recentSignups.filter(s => s.hasClaimedPromo).length / recentSignups.length;

    if (promoClaimRate > 0.8) {
      patterns.push({
        patternId: `burst_${ipData.asn.asn}_${Date.now()}`,
        patternType: 'signup_burst',
        accountsInvolved: recentSignups.map(s => s.id),
        promoValueAtRisk: recentSignups.length * promoRequest.promoValue,
        detectionConfidence: 0.88
      });
    }
  }

  // Detect referral chains
  if (promoRequest.type === 'referral') {
    const referralChain = await traceReferralChain(promoRequest.referrerCode, {
      maxDepth: 5,
      minChainLength: 3
    });

    if (referralChain.isCircular || referralChain.hasDeadEnds) {
      patterns.push({
        patternId: `referral_chain_${accountId}`,
        patternType: 'referral_chain',
        accountsInvolved: referralChain.accounts,
        promoValueAtRisk: referralChain.totalBonusValue,
        detectionConfidence: 0.91
      });
    }
  }

  // Detect coupon clustering
  const couponUsage = await getCouponUsageFromASN(ipData.asn.asn, promoRequest.couponCode);
  if (couponUsage.uniqueAccounts > 50 && couponUsage.avgTimeBetweenUses < 300) {
    patterns.push({
      patternId: `coupon_cluster_${promoRequest.couponCode}`,
      patternType: 'coupon_cluster',
      accountsInvolved: couponUsage.accountIds,
      promoValueAtRisk: couponUsage.totalDiscountValue,
      detectionConfidence: 0.85
    });
  }

  return patterns;
}