How Geocomply detect suspicious activity?

[Cloned Boy]

Geocomply is an anti-fraud and geolocation control system used in online casinos, fintech and payments (e.g. PokerStars, BetMGM, PayPal).

It analyzes dozens of parameters to distinguish a real user from a fraudster. Here are the key detection methods:

1. IP address analysis​

Geocomply checks:

• IP type:
  • Residential (home/mobile) → safe.
  • Data center (AWS, DigitalOcean) → suspect.
• IP Geolocation:
  • Inconsistency with stated location → risk.
• IP history:
  • If the IP was used for fraud before → blocking.

Example:

• User from Moscow connects via German VPN → Geocomply sees that IP belongs to Hetzner → risk flag.

2. GPS and Wi-Fi/Cell Tower data​

When an application requests access to geodata, Geocomply checks:

• GPS accuracy:
  • GPS spoofing (Fake GPS Apps) often gives inaccurate coordinates.
• Wi-Fi/Cell Tower Matching:
  • If GPS shows "New York" and the Wi-Fi router is registered in Russia → detection.

How to bypass (and how Geocomply catches):

Bypass method	How is it detected?
Fake GPS (Android)	Root/jailbreak verification.
GPS Emulation on PC	Lack of real Wi-Fi/Cell Tower.
VPN + GPS Spoofing	IP and GPS mismatch.

3. Fingerprinting​

Geocomply analyzes:

• Browser: User Agent, screen resolution, WebGL rendering.
• OS: System version, installed fonts.
• Hardware: MAC address, CPU/GPU model.

Example:

• You are logged in from Windows, but the User Agent says "iPhone" → suspected.

4. Behavioural analysis​

• Speed of action: Bots work faster than humans.
• Mouse/Keyboard Patterns: AI checks if it's a human.
• Session time: If you enter from the Russian Federation, and 5 minutes later from the USA → fraud.

5. Network and operator data​

• IMSI/MCC code of the SIM card: Compared with IP.
• DNS queries: DNS spoofing (e.g. via dnsmasq) can be detected.

Example :

• You are in Russia, but DNS servers are from the Netherlands → Geocomply will suspect a proxy.

6. How does Geocomply block scammers?​

1. Risk scoring: Each action is assigned a risk score (0–100).
2. Auto-moderation:
   • Low risk (0–30) → Passes.
   • Medium risk (31–70) → Requires 2FA/SMS.
   • High risk (71–100) → Blocking.
3. Manual verification: Suspicious cases are sent to fraud analysts.

7. How is Geocomply tested (legally)?​

For research you can:

1. Analyze requests via Burp Suite/Fiddler.
2. Emulate devices using Selenium + Puppeteer.
3. Participate in a Bug Bounty (for example, at PokerStars).

Important: Bypassing Geocomply in the combat system violates laws (for example, CFAA in the US).

Conclusion​

Geocomply is a complex system that combines:
Geolocation (IP, GPS, Wi-Fi).
Fingerprinting (browser, OS, hardware).
Behavioral analysis (mouse, keyboard, time).

For protection:

• Use residential proxies (not data center ones).
• Avoid root/jailbreak.
• Don't mix VPN with Fake GPS.

Need technical details on how to bypass it? I don't support illegal actions, but I can explain how similar systems work (for example, banking anti-fraud mechanisms).