Risk Scoring for Laravel
Data sources
Data sources
Free-core signals use only sources with clean licenses and no paid gate. Paid / keyed providers are strictly opt-in. Nothing here sends your users' data to a third party except where you explicitly enable it (StopForumSpam, and any paid driver you add).
Shipped (free-core)
| Source | Used by | License | Cost | Refresh |
|---|---|---|---|---|
| stamparm/ipsum | ip.reputation |
Unlicense (public domain) | Free, no key | risk:refresh-ipsum — daily |
| Tor bulk exit list | ip.tor_exit |
Public | Free | risk:refresh-tor — hourly |
| Bundled disposable-domain list | email.disposable |
starter subset; full list from amieiro is MIT | Free | manual / your schedule |
| System DNS (MX/A) | email.no_mx |
— | Free | per-request (cache in your resolver) |
| Your cache (Redis) | velocity |
— | — | live |
The honeypot and user-agent signals use no external data at all.
Opt-in (shipped, enable in config)
| Source | Used by | License | Cost / limits |
|---|---|---|---|
| StopForumSpam API | ip.stopforumspam |
Data is CC BY-NC — fine for a self-hoster protecting their own site, not for resale | Free; ~20k lookups/day. Cached per IP, short timeout, fail-open. For high volume prefer the downloadable dump behind a custom IpReputation. |
Opt-in (bring your own key / implementation)
Add these as a custom Signal or by binding IpReputation / DisposableDomains
(see Extending):
| Source | License / cost | Notes |
|---|---|---|
| AbuseIPDB | Free 1k/day, paid tiers; attribution + key | abuseConfidenceScore 0–100 maps straight to points |
| Spamhaus DNSBL | Free for low-volume/non-commercial via public mirrors; DQS (paid) otherwise | XBL/PBL zones; a cheap DNS query |
| Project Honey Pot http:BL | Free with key | web-traffic oriented threat score |
| IP2Location LITE | CC BY-SA (attribution) | country/ASN — high-risk country + datacenter detection. Preferred over MaxMind (friendlier license, no account gate) |
| MaxMind GeoLite2 | Restrictive EULA (no redistribution, 30-day updates), account + key | do not bundle; support as a driver only |
| IPQualityScore / IPHub | free tiers + paid | residential-proxy / VPN detection |
| HIBP Pwned Passwords | Free, no key, k-anonymity | breached-password check at registration/change |
License obligations to honor
- IP2Location LITE and the disposable-domain lists: attribution required.
- StopForumSpam: non-commercial data — self-host use only, don't resell.
- MaxMind: don't redistribute the DB; auto-update within 30 days if you use it.
- ipsum (Unlicense) and HIBP passwords: no obligations — the cleanest to ship on by default.
Keep this page current when you add or swap a source — it's the honest record of what your deployment talks to.