Bot Detection for
Insurance

# Python — Pre-screen quote requests before hitting rating engine
import httpx

async def screen_quote_request(request):
    """Screen insurance quote requests for bot/fraud signals"""
    ip = request.headers.get("X-Forwarded-For", request.client.host)
    
    async with httpx.AsyncClient() as client:
        resp = await client.get(
            f"https://api.ipasis.com/v1/lookup/{ip}",
            headers={"Authorization": "Bearer YOUR_API_KEY"},
            timeout=0.05  # 50ms timeout — don't block UX
        )
        data = resp.json()
    
    risk = data.get("risk_score", 0)
    is_datacenter = data.get("is_datacenter", False)
    is_proxy = data.get("is_proxy", False)
    is_vpn = data.get("is_vpn", False)
    is_tor = data.get("is_tor", False)
    
    # Block obvious bots — save rating engine costs
    if risk >= 0.85 or is_tor:
        return {"action": "block", "reason": "high_risk_ip"}
    
    # Flag datacenter/proxy traffic for manual review
    if is_datacenter or is_proxy:
        return {"action": "flag", "reason": "suspicious_infrastructure"}
    
    # VPN users get extra verification (phone/email)
    if is_vpn and risk >= 0.5:
        return {"action": "verify", "reason": "vpn_medium_risk"}
    
    # Clean traffic proceeds to rating engine
    return {"action": "allow", "risk_score": risk}

// Node.js — Claims intake fraud signal enrichment
async function enrichClaimSignals(claimData, clientIP) {
  const ipData = await fetch(
    `https://api.ipasis.com/v1/lookup/${clientIP}`,
    { headers: { Authorization: 'Bearer YOUR_API_KEY' } }
  ).then(r => r.json());

  const fraudSignals = [];

  // Datacenter IPs filing claims = major red flag
  if (ipData.is_datacenter) fraudSignals.push('DATACENTER_IP');
  if (ipData.is_proxy) fraudSignals.push('PROXY_DETECTED');
  if (ipData.is_tor) fraudSignals.push('TOR_EXIT_NODE');
  if (ipData.is_vpn) fraudSignals.push('VPN_DETECTED');

  // Geographic mismatch: claim location vs IP location
  if (claimData.incidentState && ipData.region &&
      claimData.incidentState !== ipData.region) {
    fraudSignals.push('GEO_MISMATCH');
  }

  // Multiple claims from same IP range (fraud ring indicator)
  const recentClaims = await db.claims.count({
    ip_asn: ipData.asn,
    created_at: { $gte: new Date(Date.now() - 7 * 86400000) }
  });
  if (recentClaims > 3) fraudSignals.push('CLUSTER_PATTERN');

  return {
    risk_score: ipData.risk_score,
    fraud_signals: fraudSignals,
    route: fraudSignals.length >= 2 ? 'SIU_REVIEW' : 'STANDARD',
    ip_metadata: {
      country: ipData.country,
      region: ipData.region,
      asn: ipData.asn,
      org: ipData.org,
    }
  };
}