How VPN Detection Stops Fraud: A Technical Guide for E-commerce Platforms

const express = require('express');
const axios = require('axios');

const app = express();

// VPN Detection Middleware
async function detectVpn(req, res, next) {
  const clientIp = req.ip || req.connection.remoteAddress;

  try {
    const response = await axios.get(
      `https://api.ip-info.app/v1/geolocate/${clientIp}`,
      {
        headers: {
          'x-api-key': process.env.IP_INFO_API_KEY,
          'accept': 'application/json'
        },
        timeout: 1000
      }
    );

    const ipData = response.data;
    const riskScore = calculateRiskScore(ipData);

    // Add to request for downstream use
    req.ipData = {
      ...ipData,
      riskScore,
      isVpnOrProxy: ipData.vpn || ipData.proxy || ipData.tor
    };

    next();
  } catch (error) {
    console.error('VPN detection failed:', error);
    // Fail open - don't block transactions if API is down
    req.ipData = { riskScore: 0, isVpnOrProxy: false };
    next();
  }
}

function calculateRiskScore(ipData) {
  let score = 0;

  // VPN/Proxy detection
  if (ipData.vpn) score += 40;
  if (ipData.proxy) score += 35;
  if (ipData.tor) score += 50;

  // Data center/hosting IP
  if (ipData.isHosting) score += 25;

  // Mobile carrier (lower risk)
  if (ipData.isMobile) score -= 10;

  // Residential IP (lowest risk)
  if (ipData.isResidential) score -= 15;

  return Math.min(100, Math.max(0, score));
}

// Apply to checkout routes
app.use('/api/checkout', detectVpn);

// Checkout endpoint with VPN blocking
app.post('/api/checkout', async (req, res) => {
  const { riskScore, isVpnOrProxy } = req.ipData;

  if (isVpnOrProxy && riskScore > 70) {
    return res.status(403).json({
      error: 'Transaction blocked',
      reason: 'High-risk IP detected',
      requireVerification: true
    });
  }

  if (riskScore > 50) {
    // Require additional verification
    return res.status(200).json({
      requireTwoFactor: true,
      message: 'Additional verification required'
    });
  }

  // Process normally
  await processTransaction(req.body);
  res.json({ success: true });
});