wavewon
Newbie
- May 13, 2025
- 6
- 0
Introduction
This is a simple tutorial on blocking fraudulent. Fraudulent traffic typically gets sorted into two main categories:
- Browser Based: Actions are performed using a headless browser like selenium. Javascript, loading of assets are performed in the background.
- Requests Based: Actions are performed using HTTP requests. High skill
In general when you are trying to protect your paywall you are dealing with the latter which are Browser Based bots. These bots are typically designed to blend in not stand out with a whole market around anti-detect browsers.
Detection
You typically don't want to fall back on a single data source. When dealing with fake traffic you want to look a number of indicators that help you segment your traffic and figure out what to block and what to keep.
IP Information
IP addresses aren't the best indicator due to a number of reasons, often times you can have a number of users on the same ip address or that ip being sold by proxy providers. There are a number of signs which can still be valuable though:
- ASN Information: This is the network which the ip address is on. If you see a lot of traffic from the same ASN that is usually a redflag.
- Datacenters: Datacenter IP addresses are usually ip's which you want to outright block or watch out for. They are normally used for fraudulent bot farms or vpns.
- IP Risk Score: Keep an eye out if the ip address is known blocklists.
You can typically use a free ip api to get most of this information from a user which you can then send to your servers for further analysis or separating the traffic into malicious or non malicious.
fetch("https://api.geoipapi.com/json").then( data =>
console.log(data)
// or send to server up to you
);
Browser Fingerprinting
Another common technique you see being used is browser fingerprinting. Theres a couple of opensource libraries that do this. Essentially you are taking all the characteristics of a browser and assigning it a unique identifier. This unique identifier allows you to detect repeat users that might be abusing your platform or service.
https://github.com/abrahamjuliot/creepjs
https://github.com/fingerprintjs/fingerprintjs
Typically it's recommended to go with a paid provider that can maintain the fraud detection for you since it requires constant updates.
Behavioral
This is pretty intuitive but your system should track the behaviors performed by users and see what their flow looks like. Are they interacting with all your pages or just some of them? You can use trackers to watch action flows which might indicate automated behavior.
Conclusion
Hope this guide was helpful! Leave a comment if you have questions.
This is a simple tutorial on blocking fraudulent. Fraudulent traffic typically gets sorted into two main categories:
- Browser Based: Actions are performed using a headless browser like selenium. Javascript, loading of assets are performed in the background.
- Requests Based: Actions are performed using HTTP requests. High skill
In general when you are trying to protect your paywall you are dealing with the latter which are Browser Based bots. These bots are typically designed to blend in not stand out with a whole market around anti-detect browsers.
Detection
You typically don't want to fall back on a single data source. When dealing with fake traffic you want to look a number of indicators that help you segment your traffic and figure out what to block and what to keep.
IP Information
IP addresses aren't the best indicator due to a number of reasons, often times you can have a number of users on the same ip address or that ip being sold by proxy providers. There are a number of signs which can still be valuable though:
- ASN Information: This is the network which the ip address is on. If you see a lot of traffic from the same ASN that is usually a redflag.
- Datacenters: Datacenter IP addresses are usually ip's which you want to outright block or watch out for. They are normally used for fraudulent bot farms or vpns.
- IP Risk Score: Keep an eye out if the ip address is known blocklists.
You can typically use a free ip api to get most of this information from a user which you can then send to your servers for further analysis or separating the traffic into malicious or non malicious.
fetch("https://api.geoipapi.com/json").then( data =>
console.log(data)
// or send to server up to you
);
Browser Fingerprinting
Another common technique you see being used is browser fingerprinting. Theres a couple of opensource libraries that do this. Essentially you are taking all the characteristics of a browser and assigning it a unique identifier. This unique identifier allows you to detect repeat users that might be abusing your platform or service.
https://github.com/abrahamjuliot/creepjs
https://github.com/fingerprintjs/fingerprintjs
Typically it's recommended to go with a paid provider that can maintain the fraud detection for you since it requires constant updates.
Behavioral
This is pretty intuitive but your system should track the behaviors performed by users and see what their flow looks like. Are they interacting with all your pages or just some of them? You can use trackers to watch action flows which might indicate automated behavior.
Conclusion
Hope this guide was helpful! Leave a comment if you have questions.
