ISP & ASN Reputation Database

prepare(
        "SELECT asn FROM ip_to_asn
         WHERE ip_start <= INET6_ATON(:ip)
           AND ip_end   >= INET6_ATON(:ip)
         LIMIT 1"
    );
    $stmt->execute(['ip' => $ip]);
    $asn_row = $stmt->fetch(PDO::FETCH_ASSOC);
    if (!$asn_row) return null;

    // Step 2: Get the reputation profile for this ASN
    $stmt = $pdo->prepare(
        "SELECT asn, isp_name, type, country, abuse_score,
                is_hosting, is_mobile, risk_level
         FROM isp_reputation WHERE asn = :asn"
    );
    $stmt->execute(['asn' => $asn_row['asn']]);
    return $stmt->fetch(PDO::FETCH_ASSOC) ?: null;
}

// Usage: enrich your fraud scoring with ISP data
$ip = $_SERVER['REMOTE_ADDR'];
$isp = get_isp_reputation($pdo, $ip);

if ($isp) {
    $fraud_score = 0;

    // Hosting provider traffic is suspicious for user-facing apps
    if ($isp['is_hosting']) $fraud_score += 30;

    // High abuse score adds to risk
    if ($isp['abuse_score'] > 70) $fraud_score += 25;
    elseif ($isp['abuse_score'] > 40) $fraud_score += 10;

    // Critical risk networks
    if ($isp['risk_level'] === 'critical') $fraud_score += 40;

    // Combine with other signals (VPN check, email check, etc.)
    $total_risk = calculate_total_risk($fraud_score, $other_signals);
}

import sqlite3
import ipaddress

DB_PATH = "antiproxies_isp.db"

def get_isp_info(ip: str) -> dict | None:
    """Look up ISP reputation for an IP address."""
    conn = sqlite3.connect(DB_PATH)
    conn.row_factory = sqlite3.Row
    ip_int = int(ipaddress.ip_address(ip))

    # Step 1: IP to ASN
    asn_row = conn.execute(
        "SELECT asn FROM ip_to_asn WHERE ip_start <= ? AND ip_end >= ? LIMIT 1",
        (ip_int, ip_int)
    ).fetchone()

    if not asn_row:
        conn.close()
        return None

    # Step 2: ASN reputation
    isp = conn.execute(
        """SELECT asn, isp_name, type, country, abuse_score,
                  is_hosting, is_mobile, risk_level
           FROM isp_reputation WHERE asn = ?""",
        (asn_row["asn"],)
    ).fetchone()

    conn.close()
    return dict(isp) if isp else None

# Example: Django middleware that tags every request with ISP info
class ISPReputationMiddleware:
    def __init__(self, get_response):
        self.get_response = get_response

    def __call__(self, request):
        isp = get_isp_info(request.META.get("REMOTE_ADDR", ""))
        request.isp_info = isp
        request.is_high_risk_network = (
            isp and (isp["is_hosting"] or isp["abuse_score"] > 60)
        )
        return self.get_response(request)