Hosting is one of the easiest things in the world to buy with a stolen card. Provisioning is instant, the first invoice is small enough to slip under a cardholder's radar, and the attacker gets a live server in minutes to send phishing, host malware, or mine the trial period. You eat the chargeback, the chargeback fee, and — worse — the IP and domain reputation damage when your range lands on Spamhaus.
Blesta's order system ships with two anti-fraud integrations that score every signup before it provisions: MaxMind minFraud and FraudLabs Pro. This guide is for hosts running the Blesta billing platform who take card payments through the public order forms and want orders held or rejected on a risk score instead of cleaned up after the chargeback lands.
Where anti-fraud lives in Blesta
Anti-fraud is part of the Order plugin, not a core setting. You configure it per company:
Settings → Company → Plugins → Order System (Manage) → Anti-Fraud.
If you run multiple companies in one Blesta install, each has its own anti-fraud config and its own API credentials. The screening runs synchronously when the visitor submits the order form — it is not a cron job, so there's nothing to schedule. (Your provisioning still depends on the cron; see Blesta cron setup if accepted orders aren't activating.)
Pick a provider
Both providers return a numeric risk score that Blesta compares against two thresholds. The difference is pricing and signal mix.
| MaxMind minFraud | FraudLabs Pro | |
|---|---|---|
| Credential | License key | API key |
| Pricing model | Pay-per-query, fractions of a cent | Free "micro" tier, then paid plans |
| Strongest signal | IP/email/BIN risk, proxy detection | Velocity rules, email/phone, blocklists |
| Best for | High order volume | Low-to-moderate volume, getting started |
If you're just turning fraud screening on for the first time and your order volume is modest, start with FraudLabs Pro's free tier — it costs nothing to validate the workflow. If you push real volume, MaxMind's per-query pricing usually wins and its proxy/VPN detection is harder to evade.
Configure MaxMind minFraud
- Create a MaxMind account and generate a license key tied to the minFraud service.
- In Blesta's Anti-Fraud section, set Type to
Maxmind. - Leave Server at
minfraud.maxmind.com. - Paste the License Key.
- Set Anti-Fraud Frequency to run fraud checks for all orders and customer signups — the whole point is to screen everyone, not a sample.
- Set the two thresholds (covered below).
minFraud returns a risk score from roughly 0.01 to 99 representing the probability the order is fraudulent. Blesta maps that directly onto its reject/review thresholds.
Configure FraudLabs Pro
- Sign up at fraudlabspro.com and grab your API key (the free micro plan is enough to start).
- Set Type to
FraudLabsProand paste the API Key. - Set Anti-Fraud Frequency to all orders and signups.
- Optionally enable Auto Reject/Review to defer to FraudLabs Pro's own recommendation instead of, or alongside, your numeric thresholds.
Set the thresholds
Two numbers decide the fate of every order:
- Minimum Score to Reject — default
80. An order scoring at or above this is rejected outright. The customer sees a generic failure; nothing provisions. - Minimum Score to Review — default
10. An order between this and the reject threshold is held as Pending for a human to look at.
The defaults are deliberately conservative: reject only the obvious, review a wide band. Run them as-is for the first couple of weeks, watch your review queue, then tighten. If you're seeing fraud slip through with scores in the 60s, lower the reject threshold. If legitimate customers keep landing in review, raise the review threshold.
How flagged orders flow
When an order trips the review threshold it stays in Pending. Nothing activates. A staff user opens it under the order queue and moves it to one of two buckets:
- Accept → the client account is activated and provisioning proceeds (e.g. the cPanel provisioning module creates the account).
- Fraud → the client account is flagged as fraud in Blesta and nothing provisions.
Marking an order Fraud is the right call for the genuinely bad ones — it tags the client record so repeat attempts from the same account are obvious.
What to check when reviewing
For an order in the review band, the manual signals that resolve most cases in under a minute:
- Billing country vs. IP country. A mismatch isn't proof, but combined with anything else it's a strong tell.
- Free or disposable email on a "company" order, especially paired with a high-value plan bought monthly rather than annually.
- Name vs. card. Cardholder name not matching the account name.
- Velocity. Several orders from the same IP, card BIN, or email pattern in a short window.
When in doubt, ask for ID or a different payment method before activating. Fraudsters disappear when challenged; real customers reply.
Verify it's actually screening
Place a test order and confirm the module fired. In a healthy setup you'll see the fraud score recorded against the order, and an order you craft to look risky (mismatched country, throwaway email) lands in Pending instead of activating. If every order sails straight to Active, re-check that the Anti-Fraud Frequency is set to all orders and that the license/API key is valid — a bad key fails open on some configurations, which is the worst outcome: you think you're protected and you're not.