So I have a site where users can create online surveys and send them out to whomever they like. Over the past few months we have seen an uptick in one particular user who creates an account, then creates a survey where he requests user names and passwords for a different site. It's always the same site that he targets, and he always asks the same sorts of questions.
Our best solution up until now has been to create a monitoring service that searches for potentially malicious surveys and then notifies us when they are found. We then go in and manually review the survey and lock the account if it's up to something shady.
This has not been very effective. Even though the surveys are locked fairly quickly the malicious user still finds value in endlessly creating these surveys under new accounts and sending them out.
The best idea I've come up with is to not allow a survey to be activated by the user if it contains suspect keywords. Require and admin to review and activate it. The problem with this is that there are many false positives that get picked up, so I would need to perform an action more often than I do now in order to let the legit surveys go live.
Can anyone suggest an effective way to thwart this person without spending a chunk of my day performing manual tasks? Is there some way to fingerprint this user to prevent him from using our site for phishing?