Preventing Fake Account Creation with IP Reputation Analysis

Fake account creation (Sybil attacks) is a primary vector for platform abuse, including promo abuse, spam, and credential stuffing. While CAPTCHAs offer a frontend defense, they degrade UX and are increasingly solved by AI-driven solvers or click-farms.

backend IP reputation analysis provides an invisible, deterministic layer of security. By analyzing the connection type and history of an IP address before processing a registration request, engineers can reject high-risk traffic without user friction.

The Signals of Fraudulent Traffic

Legitimate users rarely sign up via datacenter proxies or Tor exit nodes. When designing your registration endpoint defenses, prioritize these IP intelligence signals:

1. Connection Type: Distinguish between Residential (ISP) IPs and Datacenter/Hosting IPs. A hosting classification on a sign-up route is a 95%+ indicator of a bot.
2. Privacy Tools: Detection of active VPNs, TOR nodes, or public proxies.
3. Abuse History: Historical data indicating if the IP has recently participated in DDoS attacks or spam campaigns.
4. ISP/ASN Velocity: High volumes of requests from a single Autonomous System Number (ASN) within a short window.

Implementation: Middleware Logic

The most efficient implementation is a middleware check prior to database writes or expensive auth logic. Below is a Python implementation using Flask and the IPASIS API to gate a registration endpoint.

Python (Flask) Example

import requests
from flask import Flask, request, jsonify, abort

app = Flask(__name__)

IPASIS_API_KEY = 'YOUR_API_KEY'

def check_ip_reputation(ip_address):
    url = f"https://api.ipasis.com/v1/lookup?ip={ip_address}&key={IPASIS_API_KEY}"
    try:
        response = requests.get(url, timeout=2)
        if response.status_code == 200:
            return response.json()
        return None # Fail open or closed depending on policy
    except Exception as e:
        # Log error
        return None

@app.route('/api/register', methods=['POST'])
def register_user():
    client_ip = request.remote_addr
    
    # 1. Get IP Intelligence
    ip_data = check_ip_reputation(client_ip)
    
    if ip_data:
        security = ip_data.get('security', {})
        connection = ip_data.get('connection', {})
        
        # 2. Hard Block Rules
        if security.get('is_tor') or security.get('is_proxy'):
            return jsonify({"error": "Registration denied: Anonymizer detected."}), 403
            
        # 3. Soft Block / Challenge Rules
        if connection.get('type') == 'hosting':
             # Trigger 2FA or Phone Verification requirement here
             return jsonify({"action": "require_phone_verification"}), 200

    # Proceed with standard registration logic
    return jsonify({"status": "success"}), 201

Handling False Positives

Aggressive blocking can impact legitimate privacy-conscious users. Instead of a binary Allow/Block, implement a tiered response system based on the IP risk score:

• Residential IP (Clean): Allow frictionless sign-up.
• Commercial VPN (Clean History): Require email verification or CAPTCHA.
• Datacenter IP / Tor / High Abuse Score: Hard block or require SMS verification (raising the cost of attack).

FAQ

Q: Should I block all VPN traffic? A: Not necessarily. For B2B applications, corporate VPNs are common. However, for B2C social platforms or e-commerce, blocking commercial VPNs during registration (not login) is a standard practice to prevent ban evasion and multi-accounting.

Q: How does this affect IPv6 adoption? A: Modern IP intelligence providers, including IPASIS, support full IPv6 lookup. Attackers often utilize IPv6 subnets because they are cheaper to lease. Ensure your logic parses IPv6 headers correctly.

Q: What about latency? A: IP reputation checks typically add 50-150ms to the request. Since registration is a low-frequency, high-value event, this latency is negligible compared to the cost of cleaning up fake accounts later.

Secure Your User Base with IPASIS

Stop bots at the gate. IPASIS provides enterprise-grade detection for proxies, VPNs, and high-risk ASNs with low-latency response times.

Get your free API key and start filtering bad traffic today.