Swoosh Fraud Engine

Customer Portal

Your key is kept in this browser only (localStorage) and sent as an x-api-key header.

Overview

–

checks

–

blocked

–

block rate

–

avg score (threshold 60)

Top flags

Connect to load your data.

Recent checks

Time (local)	Email	Score	Verdict	Evidence flags
No data yet.

Test console

Sends a real POST /api/fraud/score with your key. The example below is safe test data (TEST-NET IP, reserved 555 phone). Edit any field and score it.

—

Evidence flags

Run a check to see the evidence.

Tier breakdown

API documentation

Authentication

Every request carries your key in an x-api-key header (or Authorization: Bearer). Keys are issued per customer and scope all data access to your own traffic. GET /api/fraud/health is open for monitoring.

Score a lead

curl -X POST https://fraud.bridgepointautomation.com/api/fraud/score \
  -H "content-type: application/json" \
  -H "x-api-key: YOUR_KEY" \
  -d '{
    "ip": "192.0.2.44",
    "email": "jane.sample@example.com",
    "phone": "5125550142",
    "first_name": "Jane", "last_name": "Sample",
    "zip": "78701", "state": "TX",
    "user_agent": "Mozilla/5.0 ...",
    "referrer_url": "https://your-landing-page.example/apply",
    "utm_source": "publisher_123",
    "form_fill_time_ms": 48000,
    "mouse_distance": 5400, "mouse_move_events": 220,
    "keystroke_count": 96, "paste_events": 0,
    "scroll_depth_pct": 80, "click_count": 9
  }'

Required: ip, email, phone. Everything else is optional and only ever improves accuracy — behavioral telemetry (mouse_*, keystroke_count, form_fill_time_ms, …) powers the bot-behavior tiers, and traffic-source fields (referrer_url, utm_*) power incentivized-traffic detection. If telemetry is absent the engine skips those tiers rather than guessing — absence of data is never treated as fraud.

Response

{
  "allowed": true,          // verdict at the block threshold
  "score": 15,              // 0-100 (higher = riskier)
  "reason": "clean",        // one-word reason when blocked
  "flags": ["high_entropy:jane94x2"],   // the complete evidence trail
  "details": { "ip_score": 0, "email_score": 15, ... },  // per-tier subtotals
  "processing_ms": 41
}

Fail-open guarantee: if scoring errors or times out, the response is {"allowed": true, "reason": "fail_open"} — an engine problem can never cost you a lead. Every decision is logged and visible in this portal.

Other endpoints

Endpoint	What it returns
`GET /api/fraud/check-ip/:ip`	Datacenter/blocklist status, geo, recent activity for one IP
`GET /api/fraud/check-email/:email`	MX validity, disposable-domain and pattern analysis
`GET /api/fraud/check-phone/:phone`	Validity, area-code state, fake-pattern analysis
`GET /api/fraud/portal/overview?period=24h\|7d\|30d`	Your stats, top flags, and recent checks (powers this page)
`GET /api/fraud/health`	Service health (no auth required)

Flag glossary (most common)

dupe_email_180d: Same email already submitted within 180 days
dupe_phone_180d: Same phone already submitted within 180 days
dupe_name_zip_30d: Same name + ZIP combination within 30 days
datacenter_ip: IP belongs to a hosting provider (AWS, GCP, OVH, …), not a consumer ISP
tor_exit / vpn_range: IP is a known Tor exit node / commercial VPN range
asn_high / asn_med: The IP's network has an elevated fraud rate in our outcome data (rate- and volume-normalized)
disposable_email: Email domain is a throwaway/temporary mail service
high_entropy: Email local-part looks machine-generated (random letters + numbers)
email_name_no_overlap: Email shares nothing with the submitted name (weak signal, low points)
incentive_referrer: Traffic arrived from a known rewards / survey / get-paid-to domain
no_mouse / no_scroll: Telemetry was collected but shows no human interaction pattern
no_telemetry: Marker only, zero points: no behavioral data was collected, so behavioral tiers were skipped
pblock_mobile / pblock_voip: Phone number's NANPA carrier block class (informational carrier intelligence)
zip_ip_mismatch + geo_amplifier: Submitted ZIP disagrees with IP geolocation — only adds points when other risk is already present
whitelisted: IP is on your approved test list; scoring bypassed

Overview Last hour Last 24 hours Last 7 days Last 30 days