Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What kind of things would you check in a domain and IP scoring system? Which things are the most important?

If I have a web site or web service, I would like to figure out a score for my visitor. If their score is below a certain score I will present them will extra security measures such as a CAPTCHA or block them altogether if the score is extremely low.

share|improve this question
Check for a list of possible sources – Dog eat cat world Jun 5 '12 at 6:49
up vote 1 down vote accepted

Which things are the most important?

Really you don't know very much from an IP address. First thing to note is that an ip address is not the same thing as a user - particularly (and increasingly) with ipv4 addresses. If you've got a significant amount of traffic and identifiable patterns of fraud then you can start building your own reputation database.

Some key points are:

  • don't use IP addresses - use netblocks from the whois lookup
  • it may be advantageous to differentiate by geography - at least at the country level - there are free lists of net blocks by country
  • beware of small networks (up to /10) they are usually servers not end users
  • if you've got an authentication mechansim, then track what netblocks individual customers use - apply additional authentication when accessed from a network not seen in the N interactions / the last M weeks for this custmoer
  • using reputation services may not have huge benefit - apart from spammer listings, these are usually populated by organisations running services which might be subject to big losses - if you're not running an online banking / payment system then you'll be targeted in a very different way
  • use the time (at the client) to determine risk (does customer A usually access the system between, say 11pm and 6am?)
  • if possible check the local time on the client matches the expected timezone for the IP address
  • watch out for multiple users from the same IP address - once a user has authenticated at an IP address, apply additional checks for the next X units of time for different users from the same IP address

I've not specified exact values for M, N and X - ideally these should be adjustable by network - differentiating between home ADSL/Cable providers, mobile network providers, overseas locations and others.

Track authentication failures - these are your first level of abuse detection.

share|improve this answer

Are you talking about something like SiteAdvisor?

They do automated downloads and malware scans, link reputation to other domains already tested, email spam checks, browser exploits. Unfortunately, they pretty much killed off their user community, but that was also a good source of information.

share|improve this answer
Yes, but checking the other way around - if I have a web site or web service, figuring out a score for my visitor - to potentially present them with a captcha if score isn't high enough, or block traffic if the score is very low. – Rush Frisby Jun 4 '12 at 18:38
Ah. Can you edit your question to reflect that? – rox0r Jun 4 '12 at 18:47
Updated just now – Rush Frisby Jun 4 '12 at 19:02

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.