0

Assume that I share the same IP address with others. Then if I can do something bad to intrigue practical websites, such as Google, Amazon, or jQuery to block me, then all other users will also be blocked as a "collateral damage".

I wonder how practical it is to really intrigue a real-world website to block my IP, assume that I am only limited to operation on the application layer?

I assume this situation in practice is not uncommon. Many small institutions use NAT to transfer internal IPs to a single external IP. For example, I share IP with others in Starbucks, McDonald's, or Hotels. Let's say I'm in a Hotel, as a malicious guest, how likely that I can do something bad, which can get unnoticed by the Hotel's Firewall or whatever abnormally detection mechanism, and really get myself (and the whole Hotel) banned by, say, Google? I'd say using Flooding is unlikely to work since I'll be easily identified by the Hotel. Is there any common "kill switch", which can trigger an external-facing Firewall but bypass an internal-facing one?

1
  • I doubt Google will ever ban an IP, unless it is to stop a DoS attack. Even in that case, they would probably ban it for a very short time, and display CAPTCHAS or warnings, or force 2FA rather than blocking every connection to their services.
    – reed
    Jan 2, 2021 at 14:24

1 Answer 1

0

In general, it is uncommon to assign multiple people the same public IP address unless they share an institutional structure, such as a family, employer, or educational institution. That isn't to say that it doesn't happen, since there have been reports of a Qatari ISP sending all its traffic through a small set of IPs and VPNs have this problem, but in general it's less common.

As a result, those institutions generally provide some sort of sanction to bad actors who cause problems. For example, if you act inappropriately at the workplace, you may be fired and you can be held liable in court for any damages to the company caused by your inappropriate actions. Usually targets of abuse are eager to help these institutions discover and sanction the responsible party because they want the abuse to stop.

I work for a major Internet site, and while it's certainly the case that a lot of low-level abuse may go unnoticed, when it does come to our attention, we act. If the behavior is not urgent and the actor is known, we will often ask them to fix the problem, but we will block major abusers immediately without further notice if they cause availability concerns, sometimes sending an abuse report to their provider. Sometimes this behavior occurs by accident as people frequently perform a normally rare activity very frequently and it's more expensive to our infrastructure than we expected, while still within rate limits. A lot of abuse is just flagged by automated systems which restrict activities of the problematic users, and this kind of technique is frequent among large sites.

I suspect if you really want to do so, you can, in fact, get yourself blocked, and it may not even be very difficult. You could simply create an automated system to inefficiently scrape user-visible web pages at high speed, which is a common problem for large sites. I will point out that in all likelihood, if you do so, you will find yourself at the very least without future Internet access from the people with whom you share your IP, if not more significant sanctions.

1
  • Thank you for your comment, I have edited my question to include more details. Of course I don't really want to do it myself, but it seems really interesting to do some investigation.
    – dovod74538
    Dec 3, 2020 at 13:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .