How to Install IP Address Reputation

IP Address Reputation is a serverless integration available at Azion Marketplace.

This integration uses a reputation score for a given IP address, provided by IPQualityScore. The score is based on several factors, including whether the IP address was used for spamming or other malicious activity, how often the IP address was reported as suspicious or fraudulent, and other informations.

A higher score indicates the IP address has a better reputation and is less likely to be used maliciously. On the other hand, a lower score indicates that the IP address is more likely to be used for malicious activity and should be used with caution.

Getting the integration

To install the IP Address Reputation integration provided by Azion Marketplace, follow these steps:

1. Access Azion Console > Marketplace.
2. On the Marketplace homepage, select the integration’s card.
3. Once the integration’s page opens, click the Install button, at the bottom-right corner of the page.

You’ll see a message indicating that your integration was successfully installed.

Getting the API Key at IPQualityScore

To use the IP Address Reputation, you’ll have to obtain the API key at IPQualityScore. To do so, follow these steps:

1. Create an account at IPQualityScore.
2. Wait for the email with your personal information.
   • In the email, you’ll receive your API key. You’ll need this information to configure your Azion integration later.

Configuring the integration

Setting up a firewall

To start the configuration of the IP Address Reputation integration, follow these steps:

1. On the Products menu, select Firewall in the SECURE section.
2. Click the + Firewall button.
3. Give an easy-to-remember name to your firewall.
4. Click the Functions switch to enable functions.
5. Click the Save button.

Done. Now you’ve instantiated the firewall for your function.

Setting up the Firewall function

To instantiate the IP Address Reputation integration, while still on the Firewall page:

1. Select the Functions Instances tab and follow these steps:
2. Click the + Function Instance button.
3. Give an easy-to-remember name to your instance.
4. On the dropdown menu, select the IP Address Reputation function.

• This action will load the Arguments tab, where you can add the parameters to execute your application.

5. In the Arguments tab, you’ll pass the keys you get on the IPQualityScore site and your variables. The JSON will look like this:

To run the integration, the only parameter you’ll need to configure is the api_key, passing the API key you’ve received by email from IPQualityScore.

The other fields are:

• allow_public_access_points: allows public connections. This is a boolean field, with the default value of true.
• fast: enables a fast check. When you enable this parameter, your API won’t do some forensic checks. This is a boolean field, with the default value of true.
• strictness: fraud scoring, higher values (above 2) have more chance to return false positives. This is an integer field, with the default value of 0. Use the range 0-3 for this.
• lighter_penalties: lowers the score for proxy IP addresses, preventing false positives. This is a boolean field, with the default value of true.
• user_language: the user header language. This is a string field with no default value.
• transaction_strictness: adjusts penalty weights for irregularities and fraud patterns detected on order and transaction details optionally provided with each API request. This feature is only useful when providing order and transaction details. This is an integer field with no default value.

Some other parameters, that aren’t in the JSON example provided in the Arguments box, could be used, including:

• when_score_above: sets a score threshold. Whenever the IPQS Risk Score exceeds this threshold, the function will perform the action defined by the execute argument. If the value isn’t set, then no action will be taken by the function. This is an integer field with no default value.
• execute: the action that will be performed when the when_score_above threshold was surpassed. This is a string field with three possible values: deny, drop, and add_header. There’s no default value.
• get_data_from: determines if the IP will be retrieved from a query string request from the header or the body. If the value is remote_addr, the value that will be extracted is: ngx.var.remote_addr. This is a string field with four possible values: remote_addr, querystring, body, and header. The default value is remote_addr.
• data_name: identify the field or argument from when the IPQS function will extract the IP to validate. This is only used when the parameter search_in is different from the parameter remote_addr. This is a string field, with the default value of X-Forwarded-For.

6. Click the Save button.

Setting up the Firewall Rules Engine

To finish, you have to set up the Rules Engine to configure the criteria and the behavior to run the function.

Still on the Firewall page:

1. Select the Rules Engine tab.
2. Click the + Rule Engine button.
3. Give a name to the rule.
4. Select a criteria to run and catch the domains that you want to run the integration on.

• Example: if Host matches yourdomain.com.

5. Below, select a behavior to the criteria. In this case, it’ll be Run Function.
   • Select the adequate function according to the name you gave it during the instantiation step.
6. Click the Save button.

On the Console, you must now configure your domain so your firewall protects it.

7. On the Products menu, select Woklodas.
8. Click on the domain you want to protect with your IP Address Reputation function.
9. In the Settings section, click on the Firewall selector and choose the firewall you created.
10. Click the Save button.

Done. Now the IP Address Reputation integration is running for every request made to the domain you indicated.

Important

For each field present in the results, the integration will add a request header with the prefix IPQS. For example, if the request has an ASN field, the header will have an IPQS-ASN with the same value added to the header. You can also use this information to create and manage your decisions in the Rules Engine. You can check the full list of fields.

It’s a good practice to create an application rule redirecting your request to another URL/Origin whenever the risk score is greater than 85. If you want or need it, you can follow the usage of your API key through the IPQualityScore dashboard. Every request to your firewall will count as a new request for IP address lookup.