1.1 Overview & System Architecture

eWeb Anti-Fraud Protection safeguards OpenCart merchants against fraudulent orders, stolen credit cards, card testing bot attacks, and costly dispute chargebacks. Unlike rigid rule checkers, the extension employs an intelligent multi-layered scoring matrix combining 14 native heuristics, IP geo-velocity profiling, proxy/VPN detection, and optional external intelligence (MaxMind minFraud, proxycheck.io, and OpenAI GPT-4o).

Key Architectural Pillars

• Sub-Millisecond Evaluation: Local heuristics execute in under 12ms at checkout confirmation, introducing zero perceptible latency to legitimate buyers.
• Protection Strength Ring: Dynamic SVG health gauge visualizing your store’s security posture directly in the admin dashboard.
• Multi-Threshold Quarantine: Orders scoring above configured thresholds are placed into Under Review quarantine before credit card capture occurs.
• Native eWeb Ecosystem: Integrates seamlessly with eWeb Rewards, eWeb Variant Matrix, and the centralized OpenCart eWeb admin tab bar.

1.2 System Requirements

1.3 Quick Start & Setup

1. Install Extension: Upload the extension zip via OpenCart Extensions > Installer and refresh Modifications.
2. License Activation: Enter your license key under Extensions > Anti-Fraud > eWeb Anti-Fraud > Essential.
3. Select Preset: Choose Medium Protection [Recommended] for balanced, out-of-the-box e-commerce defense.
4. Enable Switch: Toggle status to Enabled and click Save.

1.4 Protection Presets

2.1 Risk Scoring Engine (0 - 100)

Every incoming transaction receives an aggregate Risk Score ranging from 0 (Safe) to 100 (Definite Fraud). When rules trigger, their assigned weights accumulate into a normalized composite score:

2.2 Local Rules Reference (14 Built-In Rules)

2.3 Velocity & Attempt Intelligence

The AttemptIntelligenceService monitors every transaction attempt in table oc_eweb_antifraud_attempt:

• Identity Velocity: Aggregates attempts across Email, Telephone, and IP Address independently over a 24-hour sliding window.
• Attack-Mode Detection: When >50% of hourly checkout attempts result in gateway declines, store enters heightened defense with tighter velocity caps.
• FailedPaymentLimiter: Hard-blocks session checkout after 3 consecutive payment rejections to prevent credit card bin testing.

2.4 High-Risk Order Quarantine

Orders scoring above the quarantine threshold (default: 65) are immediately routed into a secure quarantine state:

• Order status is forced to Fraud Review / Quarantine.
• Instant notification email dispatched to store safety officers.
• Digital download tokens are suspended until human approval.
• Warehouse fulfillment exports exclude quarantined order IDs.

3.1 proxycheck.io (Proxy & VPN Detection)

Detects commercial VPN services, proxies, and Tor nodes using the proxycheck.io real-time API:

• Free Tier Support: Works out of the box with daily free queries or enter your dedicated API key.
• Smart Whitelisting: Built-in exclusion for Apple iCloud Private Relay (ASN 209242) and Cloudflare WARP (ASN 13335) to eliminate false positives on iOS / macOS buyers.

3.2 QuickEmailVerification Integration

Intercepts 10-minute disposable email domains (Mailinator, GuerrillaMail, TempMail) and invalid mailbox syntaxes. Supports both an offline built-in dictionary of 3,200+ disposable domains and live API validation via QuickEmailVerification.

3.3 MaxMind minFraud Integration

Connect your MaxMind account (Account ID + License Key) for global enterprise risk scoring:

• minFraud Score: Lightweight risk assessment.
• minFraud Insights: Includes device fingerprinting, IP proxy score, and IP distance to billing city.
• minFraud Factors: Granular multiplier reasons explaining exactly why an order is flagged.
• Response Caching: Each order is cached per order ID, ensuring your MaxMind query credits are never billed twice for re-reviews.

3.4 OpenAI AI-Powered Fraud Analysis

Harness GPT-4o-mini to analyze complex fraud patterns that rigid rules miss:

// Example AI analysis generated for order #10842:
"Risk Score: 78/100 (HIGH RISK)
Key Observations:
- Customer name 'John Smith' conflicts with foreign billing name 'Svetlana K.'
- Shipping address is a known parcel forwarder in Delaware.
- Order was placed at 03:14 AM local time via datacenter IP range.
Recommendation: Quarantine and request photographic proof of ID before shipment."

3.5 BigDataCloud Geolocation & IP Mismatch

Uses BigDataCloud free client APIs to verify browser GPS coordinates against billing zip codes and IP ISP location. If a customer claims a New York billing address but their browser hardware reports an Asian or Eastern European timezone and coordinates, the browser_geo_mismatch flag triggers.

4.1 Card Testing Attack Protection

Automated card-testing bots attack e-commerce checkouts by cycling thousands of stolen cards through low-value transactions. eWeb Anti-Fraud implements:

• Minimum cart threshold verification before payment tokenization.
• Hidden honeypot fields that trap automated headless browser bots.
• Rate-limiting per browser fingerprint regardless of IP rotation.

4.2 CAPTCHA (reCAPTCHA & Cloudflare Turnstile)

Supports seamless checkout bot deterrence via three providers:

• Cloudflare Turnstile: Privacy-respecting, zero-interaction visitor verification.
• Google reCAPTCHA v3: Invisible scoring (quarantines attempts with score < 0.5).
• Google reCAPTCHA v2: Classic "I'm not a robot" interactive checkbox.

4.3 Allow & Block Lists

Manage store security lists with powerful pattern matching:

• Email Exact Match: [email protected]
• Domain Wildcard: *@throwaway-domain.xyz
• Regex Patterns: /^test-[0-9]+@/
• IP Whitelist / Blacklist: Full IPv4 and CIDR subnet range support (e.g. 192.168.1.0/24).
• Auto-Blacklisting: Automatically appends confirmed fraudulent order identities to the blacklist.

4.4 PayPal Email Verification

When customers pay with PayPal, unconfirmed email accounts are sent an automated verification link. High-value digital downloads can be locked until verification is confirmed by the buyer.

4.5 Marketplace Order Detection

When importing orders from multi-channel connectors (eBay, Amazon, Etsy), customer IPs are frequently the server IP rather than the shopper's IP. The extension detects marketplace headers and automatically skips proxy and velocity rules so external orders are not wrongly flagged.

5.1 Admin Order Risk Panel

Injected into Sales > Orders > View Order Info via standard event hooks:

• Interactive Radial Risk Gauge: 0–100 SVG meter with green/amber/red dynamic color thresholds.
• Triggered Rules Breakdown: Lists each rule that fired, the point penalty, and forensic details.
• One-Click Action Buttons: Recalculate Risk | Whitelist Customer | Block IP | Re-run AI Analysis

5.2 Order List Risk Badges

Adds compact, color-coded security badges directly into the standard OpenCart Sales > Orders list table:

• SAFE (0–29) — Low risk, approved for fulfillment.
• REVIEW (30–64) — Moderate risk, check address match.
• HIGH RISK (65–100) — Quarantined, chargeback interception.

5.3 Investigation Console

Comprehensive forensic audit log recording IP history, user-agent string, DNS reverse lookups, and MaxMind insights for all flagged transactions.

6.1 Filter Hooks Reference

Copy// Filter: Modify rule list or alter weights before evaluation
add_filter('eweb/antifraud/rules', function($rules, $context) {
    // $context contains ['order' => OrderContext, 'preset' => string]
    // Customize or disable rules dynamically
    return $rules;
}, 10, 2);

// Filter: Override computed risk score
add_filter('eweb/antifraud/score_result', function($result, $context) {
    // $result = ['risk_score' => 75.0, 'risk_level' => 'high', ...]
    return $result;
}, 10, 2);

6.2 Action Hooks Reference

Copy// Action: Fires immediately after an order is scored
add_action('eweb/antifraud/order_scored', function($payload) {
    [$orderId, $result] = $payload;
    if ($result['risk_level'] === 'high') {
        // Send alert to external Slack, Discord, or CRM webhook
    }
});

6.3 Custom Rule Code Example

Copyuse Eweb\AntiFraud\RuleInterface;

class CustomB2BRule implements RuleInterface {
    public function getId(): string {
        return 'custom_tax_exempt_check';
    }

    public function evaluate($orderContext): float {
        // Award 30 risk points if order is tax exempt but no VAT ID was supplied
        if ($orderContext->isTaxExempt() && empty($orderContext->getVatId())) {
            return 30.0;
        }
        return 0.0;
    }
}

7.1 FAQ & False Positive Prevention

7.2 Licensing & Help Desk

Need assistance configuring external APIs, tuning rule weights, or setting up custom webhook triggers?

• eWeb Support Desk: Submit tickets and get priority engineer support.
• Direct Ticket Submission: Open a dedicated support ticket.