How a Small Business Improved Security with IP Intelligence

If you run a small e-commerce store, chargebacks are your absolute worst nightmare. You sell a jacket for $150, package it up, ship it out, and think you made a clean sale. Then, three weeks later, a chargeback dispute hits your merchant account. The credit card owner noticed a transaction they didn't make, their bank immediately pulls the $150 back from you, and they hit you with a $35 administration fee. You lose the sale, the inventory, the shipping costs, and get fined on top of it. This is exactly what was happening to Sarah. She runs Bella Moda, a boutique online store, and by early 2026, she was losing $4,500 every single week to chargeback fraud. The store was close to going under because their payment processor threatened to shut down their checkout entirely.

Analyzing the Fraud Signature

What made the fraud so frustrating was that it bypassed all standard verification checks. The credit card numbers were real, the billing addresses were correct, and the names matched. The scammers had bought high-quality stolen card profiles from online carding markets. The only suspicious indicators were manual. The shipping addresses were always freight-forwarding warehouses in Oregon and Florida, which wrap packages and send them overseas where scammers can pick them up without local police showing up at their doors. The orders were also consistently placed in the middle of the night, between 1 AM and 4 AM, and they always chose the most expensive express shipping option because they wanted the goods out the door before the real cardholder woke up and checked their bank app.

Digging Into the IPs

Sarah decided to look at the network logs. She exported the IP addresses from the last 100 checkout sessions—half of which were clean, and half of which turned out to be chargebacks. When she ran them through standard location searches, the IPs returned cities in the US, often near the cardholder's home. But when we dug deeper using IPDekho's ASN and network classification tools, the real pattern stood out.

While the clean orders came from standard home internet lines like Comcast, Spectrum, and AT&T, 92% of the fraudulent orders originated from data center networks and cloud hosting companies like DigitalOcean, Linode, and OVH. Regular consumers don't buy shoes using datacenter server lines. The attackers were renting SOCKS5 residential proxies and VPN connections to mask their traffic. By routing their automated checkout scripts through these proxies, their traffic looked domestic to basic shop software. However, because they used hosting networks, their Autonomous System Number (ASN) was associated with cloud server farms rather than consumer ISPs. IPDekho's ASN classification instantly flagged these connections under the "hosting" category, giving us a clear, unambiguous data point to filter on.

Building a Lightweight Security Check

Armed with this insight, Sarah's developer wrote a simple Express.js middleware script that runs during the checkout API call on their Node.js backend server. When a buyer clicks the "Complete Purchase" button and submits their payment details, the server captures the request's remote IP address and does a quick API check on that IP. If the IP's ASN belongs to a hosting provider, cloud server, or data center network, the system doesn't block the transaction outright (since some real customers might happen to shop while using a personal privacy VPN). Instead, it flags the order as "Pending Review" in the database and stops it from automatically sending to the shipping and fulfillment warehouse.

Additionally, if the IP address shows up on public spam databases or active abuse lists (verified using IPDekho's Blacklist Check tool), the payment is immediately paused, preventing transaction approval. The backend checkout middleware implementation looks like this: // E-commerce checkout middleware const ipInfo = await ipdekho.lookup(req.ip); if (ipInfo.asn.type === "hosting" || ipInfo.blacklist.isListed) { req.order.status = "PENDING_MANUAL_REVIEW"; await req.order.save(); logSecurityFlag(req.ip, "Hosting network or Blacklisted IP detected"); }

The Financial Impact

This basic check changed everything for Bella Moda. In the first 30 days of running the script, the system flagged 184 suspicious orders. Sarah's team reviewed them, tried calling the listed phone numbers, and found they were all fake or disconnected. They cancelled the shipments, saving the store over $16,000 in inventory and stopping the chargeback fees before they could register with the bank.

Normal customers browsing from home bypass the filter without ever seeing it. Within two months, the store's chargeback rate dropped by 95%, stabilizing their relationship with their payment processor. You don't need to pay for bloated, expensive fraud prevention subscriptions; looking up the ASN and network type of your incoming checkout traffic is the single most effective way to protect a small business.