Bot Detection for
SaaS Platforms

// Middleware: protect signup endpoint
app.post('/api/signup', async (req, res) => {
  const ip = req.headers['x-forwarded-for']
    || req.socket.remoteAddress;
  const { email } = req.body;

  // Check IP risk + email quality
  const [ipRisk, emailCheck] = await Promise.all([
    fetch(`https://api.ipasis.com/check?ip=${ip}`, {
      headers: { 'X-API-Key': API_KEY }
    }).then(r => r.json()),
    fetch(`https://api.ipasis.com/email?q=${email}`, {
      headers: { 'X-API-Key': API_KEY }
    }).then(r => r.json()),
  ]);

  // Datacenter + disposable email = bot
  if (ipRisk.is_datacenter
      && emailCheck.is_disposable) {
    return res.status(403).json({
      error: 'Signup blocked'
    });
  }

  // Low trust = require email verification
  if (ipRisk.trust_score < 50) {
    return res.json({
      requireVerification: true,
      verificationMethod: 'email_otp'
    });
  }

  // Clean — instant access
  return createAccount(req, res);
});