# US 2011/0218877 A1 · Detecting Online Fraud by Proxy Piercing to Identify Address of a User Device Involved in an Online Transaction > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2011/0218877 A1 - Document ID: US20110218877A1 - Status: Published application - Kind: A1 - Application number: 13/107,815 - Filed: 2011-05-13 - Published: 2011-09-08 - Earliest claimed: 2000-06-07 - Assignees: Kount Inc. - Inventors: Timothy P. Barber - Web page: https://patentgrep.com/patent/US20110218877A1 ## CPC - G06Q 20/40: Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists - G06Q 10/00: Administration; Management - G06Q 20/0855: {involving a third party} - G06Q 20/10: specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems - G06Q 20/12: specially adapted for electronic shopping systems - G06Q 20/3674: {involving authentication} - G06Q 20/382: {insuring higher security of transaction} - G06Q 20/385: {using an alias or single-use codes} - G06Q 20/401: {Transaction verification} - G06Q 30/0251: Targeted advertisements - G06Q 30/0255: {based on user history} - G06Q 30/0269: {based on user profile or attribute} - G06Q 30/0601: Electronic shopping [e-shopping] - G06Q 30/0609: {Qualifying participants for shopping transactions (payment transaction verification G06Q20/401)} - G06Q 40/12: Accounting - H04L 67/303: Terminal profiles - G06Q 30/02: Marketing; Price estimation or determination; Fundraising - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract An online machine data collection and archiving process generates a machine data profile of a customer computer accessing a transaction form of a merchant web site and links the machine data profile and a transaction record with customer identifying information using a unique transaction identification string. The process may capture parameters typically communicated as a part of web accesses, such as an IP address, an HTTP header, and cookie information. The process additionally causes the customer computer to process self-identification routines by processing coding within the merchant transaction form, the self-identification routines yielding further profile parameters. The process further includes a routine for bypassing an intervening proxy to the merchant web site to reveal the true IP address of the customer computer. Identifying the customer computer is useful for functions such as fraud detection and marketing. ## Claims ### Claim 1 A method for determining an IP address of a user device engaged in an online transaction, the method comprising: receiving from a user device a request related to an online transaction, wherein the request is associated with an apparent IP address for the user device; sending to the user device a routine, wherein the routine comprises one or more instructions to cause the user device to send a message that bypasses any proxy servers; receiving the message from the user device; obtaining an actual IP address for the user device, wherein the actual IP address is associated with the message; storing the actual IP address in connection with the online transaction; and monitoring for possible fraudulent transactions to identify suspicious behavior by a customer based at least in part on the actual IP address and an identifier for the online transaction, wherein the user device is selected from a group consisting of: a mobile communication device, an electronic game system, a television set, and a web appliance for a vehicle. ### Claim 2 (depends on 1) The method of claim 1, wherein the user device is a mobile communication device. ### Claim 3 (depends on 1) The method of claim 1, wherein the user device is an electronic game system. ### Claim 4 (depends on 1) The method of claim 1, wherein the user device is a television set. ### Claim 5 (depends on 1) The method of claim 1, wherein the user device is a web appliance for a vehicle. ### Claim 6 (depends on 1) The method of claim 1, wherein the routine comprises a redirect script. ### Claim 7 (depends on 1) The method of claim 1, wherein the routine comprises instructions to cause the user device to send the message via a protocol selected from a group consisting of TCP/IP and UDP. ### Claim 8 (depends on 1) The method of claim 1, wherein the routine further comprises instructions to query the user device to obtain a local address for the user device. ### Claim 9 (depends on 8) The method of claim 8, wherein the local address is a LAN address. ### Claim 10 (depends on 1) The method of claim 1, wherein the routine further comprises instructions to query the user device to obtain a time of day from a clock on the user device. ### Claim 11 (depends on 1) The method of claim 1, wherein the routine further comprises instructions to cause the user device to obtain time configuration settings of a clock on the user device. ### Claim 12 (depends on 1) The method of claim 1, wherein the routine further comprises instructions to cause the user device to send a transaction identifier with the message, wherein the transaction identifier is associated with the online transaction. ### Claim 13 (depends on 1) The method of claim 1, further comprising: a step for obtaining a machine data profile for the user device; and storing the machine data profile in connection with the online transaction. ### Claim 14 (depends on 1) The method of claim 1, further comprising: storing the actual IP address of the user device in connection with a customer identity profile. ### Claim 15 (depends on 14) The method of claim 14, wherein the customer identity profile is associated with a plurality of user devices. ### Claim 16 (depends on 14) The method of claim 14, wherein the customer identity profile is associated with a plurality of online transactions. ### Claim 17 (depends on 14) The method of claim 14, wherein the customer identity profile comprises one or more of a name, address, and credit card information for a user. ### Claim 18 (depends on 1) The method of claim 1, wherein the online transaction is a purchase. ### Claim 19 (depends on 1) The method of claim 1, wherein the actual IP address of the user device is different from the apparent IP address of the user device. ### Claim 20 (depends on 1) The method of claim 1, further comprising: monitoring for possible fraudulent transactions, wherein the monitoring is based at least in part on the actual IP address stored in connection with the online transaction. ### Claim 21 (depends on 1) The method of claim 1, further comprising: analyzing information related to the online transaction and the actual IP address along with information related to at least one other online transaction to monitor for possible fraudulent online transactions. ### Claim 22 A method for transacting online with a user device, the method comprising: receiving, at a transaction server, a request from a user device, wherein the request is related to an online transaction and associated with an apparent IP address for the user device; obtaining a transaction identifier that uniquely identifies the online transaction; sending from the transaction server to the user device a routine, wherein the routine comprises one or more instructions to cause the user device to: generate a message that contains the transaction identifier, and send the message to a central archiving server using a protocol that bypasses any proxy servers, wherein the message reveals an actual IP address associated with the user device; and monitoring for possible fraudulent transactions to identify suspicious behavior by a customer based at least in part on the actual IP address associated with the user device and the transaction identifier, wherein the user device is selected from a group consisting of: a mobile communication device, an electronic game system, a television set, and a web appliance for a vehicle. ### Claim 23 (depends on 22) The method of claim 22, wherein the user device is a mobile communication device. ### Claim 24 (depends on 22) The method of claim 22, wherein the user device is an electronic game system. ### Claim 25 (depends on 22) The method of claim 22, wherein the user device is a television set. ### Claim 26 (depends on 22) The method of claim 22, wherein the user device is a web appliance for a vehicle. ### Claim 27 (depends on 22) The method of claim 22, wherein the routine comprises a redirect script located on a web page served by the transaction server. ### Claim 28 (depends on 22) The method of claim 22, wherein the routine comprises instructions to cause the user device to send the message via a protocol selected from a group consisting of TCP/IP and UDP. ### Claim 29 (depends on 22) The method of claim 22, wherein the routine further comprises instructions to query the user device to obtain a local address for the user device. ### Claim 30 (depends on 29) The method of claim 29, wherein the local address is a LAN address. ### Claim 31 (depends on 22) The method of claim 22, wherein the routine further comprises instructions to query the user device to obtain a time of day from a clock on the user device. ### Claim 32 (depends on 22) The method of claim 22, wherein the routine further comprises instructions to cause the user device to obtain time configuration settings of a clock on the user device. ### Claim 33 (depends on 22) The method of claim 22, wherein the routine further comprises instructions for the user device to obtain a machine data profile for the user device and include the machine data profile with the message. ### Claim 34 (depends on 22) The method of claim 22, wherein the online transaction is a purchase. ### Claim 35 A method for archiving information about a user device engaged in an online transaction, wherein the user device has an apparent IP address, the method comprising: receiving, at a central archiving server, a message from a user device, wherein the message was sent by a routine on the user device that caused the user device to send the message by bypassing any proxy servers, and wherein the routine was provided to the user device responsive to a request from the user device related to an online transaction with a transaction server in which the request was associated with an apparent IP address for the user device; obtaining by the central archiving server an actual IP address for the user device, wherein the actual IP address is associated with the message; storing at the central archiving server the actual IP address in connection with the online transaction; and monitoring for possible fraudulent transactions to identify suspicious behavior by a customer based at least in part on the actual IP address and an identifier for the online transaction, wherein the user device is selected from a group consisting of: a mobile communication device, an electronic game system, a television set, and a web appliance for a vehicle. ### Claim 36 (depends on 35) The method of claim 35, wherein the user device is a mobile communication device. ### Claim 37 (depends on 35) The method of claim 35, wherein the user device is an electronic game system. ### Claim 38 (depends on 35) The method of claim 35, wherein the user device is a television set. ### Claim 39 (depends on 35) The method of claim 35, wherein the user device is a web appliance for a vehicle. ### Claim 40 (depends on 35) The method of claim 35, wherein the routine further comprises instructions to cause the user device to send a transaction identifier with the message, wherein the transaction identifier is associated with the online transaction. ### Claim 41 (depends on 35) The method of claim 35, further comprising: receiving a machine data profile for the user device; and storing the machine data profile in connection with the online transaction. ### Claim 42 (depends on 41) The method of claim 41, further comprising: storing the actual IP address of the user device in connection with a customer identity profile. ### Claim 43 (depends on 42) The method of claim 42, wherein the customer identity profile is associated with a plurality of user devices. ### Claim 44 (depends on 42) The method of claim 42, wherein the customer identity profile is associated with a plurality of online transactions. ### Claim 45 (depends on 42) The method of claim 42, wherein the customer identity profile comprises one or more of a name, address, and credit card information for a user. ### Claim 46 (depends on 35) The method of claim 35, wherein the online transaction is a purchase. ### Claim 47 (depends on 35) The method of claim 35, wherein the actual IP address of the user device is different from the apparent IP address of the user device. ### Claim 48 (depends on 35) The method of claim 35, further comprising: monitoring for possible fraudulent transactions, wherein the monitoring is based at least in part on the actual IP address stored in connection with the online transaction. ### Claim 49 (depends on 35) The method of claim 35, further comprising: analyzing information related to the online transaction and the actual IP address along with information related to at least one other online transaction to monitor for possible fraudulent online transactions.