Fraud Detection:IP risk assessment event and return parameters

Service event parameters

Pass service event parameters in the `ServiceParameters` field as JSON. The following table lists the IP risk assessment - event parameters.

Field name	Field description	Data format	Sample data	Required
ip	The IPv4 address to analyze.	String	42.120.XX.XX	Required

Custom return parameters

In addition to the common return parameters, the response includes custom fields in `Data`. The `score` value (0 to 1) represents risk level — higher values indicate greater risk.

The following table shows recommended threat levels. These thresholds are from the Alibaba Cloud risk control team and can be adjusted for your business.

Value range	Threat level
0 to 0.6	Low risk
0.6 to 0.8	Medium threat
0.8 to 0.95	Medium-to-high risk
0.95 to 1	High risk

The `Extend` field is a JSON string with the following fields:

Value	Description
country	Country or region name. Example: China.
province	Province name. Example: Zhejiang.
city	City name. Example: Hangzhou.
isIdc	Whether the IP belongs to a data center. 1: yes, 0: no.
isProxy	Whether the IP is a proxy. 1: yes, 0: no.
isNat	Whether the IP is a NAT address. 1: yes, 0: no.
isBase	Whether the IP is a base station address. 1: yes, 0: no.

Sample JSON response:

{
        "Data": {
                "score": 0.35, // The risk score, from 0 to 1. The format is double.
                "extend": "{\"country\":\"Thailand\",\"province\":\"\",\"city\":\"\",\"isIdc\":\"0\",\"isProxy\":\"0\",\"isNat\":\"0\",\"isBase\":\"0\"}"//Extended fields.
        },
        "Message": "OK",
        "Code": 200, // 200 indicates that the request was successful.
        "RequestId":"4EF9AEE5-288F-4176-8110-00EDC91A614E"
}