Fraud Issues & WHOIS filtering?

[Guest]

Hey Guys,

 

My stores have been targeted by some nasty folk in Africa trying to use fraudulent credit cards etc. A couple orders slipped through or existing security nets. Basically, these orders are placed to addresses, and the only tell-tale sign is that the IP generally originates from Africa somewhere, even though the billing/shipping addresses are in the US, UK, other countries we do business with a lot.

 

I would like to prevent certain IPs from ever connecting to my site, or at least, to complete processing of an order. There are probably Apache ways to do this. However it might be easier to do some sort of WHOIS lookup on every IP during checkout_process.php, and if the IP belongs to some area or country filled with fraud Ill stop the order automatically.

 

There are 'some' modules for whois lookup in the contribution, but nothing that really searches on IP or connects to the actual order process. Does something like this exist? Or am I going to be writing it this week?

 

Any tips on doing this from Apache would be off-topic, but highly appreciated as well. Just looking for the easiest way to do this.

 

Thanks,

Tom

[bglkk]

Yah, a while back we had a run of orders placed from Morocco, with the shipping and billing addresses in 'low-risk' countries throughout W. Europe.

 

The MaxMind contribution ids the ISP, ISP Org, and country code nicely. It doesn't do everything you described, but we find it makes that kind of scam obvious enough.

 

Once we picked some IPs from fraudulent orders, we banned a number of C Blocks through our merchant account, and haven't had any trouble since.

[bobg7]

Not sure if this will work or not, found it on another board.

 

id 282 : Posted on July 05, 2004 at 02:09:11  Quoted Reply

First thing you would need to do is find some way to track your users ip address, perhaps in a shoutbox.

 

1. Create a file called banned.txt This is where you will enter in users ip addresses that you want banned from the site.

You can also specify another text file to use.

 

2. Add this code to the top of your index.php page

 

<?php
/****************************

* Simple IP Banning System *

*       By Tim1.net        *

****************************/
//Configure these Settings
$filename = "banned.txt"; //Set File Name
$email = "[email protected]"; //Set your email address
$error = "You have been banned! <br>If you are wondering why, please contact admin<br>at $email.";
//No more Configuring
$ips = file($filename); //Load File into Array ips
foreach ($ips as $banned_ip) { //Loop through Ips and check if they match yours
$yourip = $_SERVER['REMOTE_ADDR']; // Store your ip into $yourip
if ($yourip == $banned_ip){
echo "$error";
exit;   	 
}
}
?>
The rest of your script below

 

The script will basically loop through all the entered ip addresses in the text file, if it finds none, it will execute the rest of the page code. If it finds an ip address that matches the one stored in $yourip, it will display the error and kill the script.

 

I have not tried this so use with caution as always.

 

Hope this helps to keep them &^*&^%'s away.

 

Bob G.