There are many ways how an adversary can pretend that he is a legitimate user (like session cookie stealing, bruteforcing the password and what not), but as far as I can see it should be rather hard for them to go unnoticed if the system tries to protect against it, e.g. by detecting that the same user is logging in from a different IP within the short period of time and moreover continue to send requests from multiple IP's simultaneously. This seem rather evident that for most cases something spooky is going on.

  • Is that really a good indication of a successful attack and system should try to prevent it somehow (I think e.g. google does)?
  • I have not seen that this widely employed, is that because it's just rather expensive to implement or because of the fact that people tend to rely on preventing identity theft in the first place?
  • 3
    Legitimate users change IP addresses. Perhaps they're moving between Wi-Fi networks on a laptop, their router gets rebooted, and several other reasons. So if you try this, you'll impact legitimate users. Also, a skilled adversary can often use their victim's IP address.
    – paj28
    Feb 4, 2016 at 10:01
  • @paj28: Thats a valid reason, if you submit it as an answer I will +1 it
    – Purefan
    Feb 4, 2016 at 10:05

1 Answer 1


There are a few reasons that IPv4 addressing is not used in this way:

  • IP addresses are not a foolproof indication of location. IP address blocks are assigned to companies and can be used anywhere they are required. A company in Asia may get a block from apnic, but then use part of their allocation in north America
  • Systems get different IP addresses all the time for legitimate reasons. The user's home ADSL router may be assigned a different address, or the user may log in using WIFI at Starbucks, a change of IP address is not a good indicator of fraud
  • A user may be using an anonymizer or VPN of some kind. A user logging in with Tor may appear to be coming from a different location entirely
  • A user may be using more than once device to log in at the same time. Many people use mobile devices at the same time as their laptops, or have a work machine and a personal machine going to the same site

These are all true with IPv4 in which IP addressing is assigned according to the network segment you are on. Using IP address changes to detect fraud will result in too many false positives.

Note that with IPv6 the second half of the address is the MAC address of the device. As MAC addresses are (supposedly) unique it may be viable to do a fraud check when a new machine address is detected logging into an account. This is what companies like Facebook are already trying to do - detecting new systems rather than IPs logging in.

  • I've heard it's quite possible to forge MAC as well. You have covered a legitimate one-time switch of an IP, but what about continuous requests from two various IP's, won't that be an indication? Feb 4, 2016 at 10:26
  • It is certainly possible to change a MAC address, you do need to know what to change it to however. If someone's computer has been compromised then this information is available to an attacker, otherwise probably not.
    – GdD
    Feb 4, 2016 at 10:41
  • It's entirely possible to have two or more legitimate requests from different IP addresses. For example I may be logging in from my laptop and mobile at the same time.
    – GdD
    Feb 4, 2016 at 10:42
  • Yes, it is possible, but this won't be a big issue if we reduce that possibility (log on from multiple devices at the same time), but I guess all in all that it's not a silver bullet at all :) Feb 4, 2016 at 11:18
  • Why would you want to reduce log on from multiple devices? If the customer wants it you should find a way to make it work.
    – GdD
    Feb 4, 2016 at 11:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.