1

We have a click exchange-type web application that allows users to receive stats boosts within a game. Stats boosts are based off unique IP addresses which poses a problem for users who use proxies or VPN, connect from home and then from cell, have a dynamic IP, connect from multiple locations (public wifi), or spoof.

We've begun tracking actively-used IP addresses for each user and have begun enforcing temporary 24-hour suspensions on those who reach the limit of 10 unique IPs in a certain period.

So far, we've received numerous reports from users claiming that these suspension have been false positives and that our filters have been inaccurate. But somehow these users always manage to hit a limit of 10 IPs.

And so our problem continues...

  • What is one of the best ways to determine whether or not a user is abusing IPs?
  • As we've been tracking IPs, we notice that sometimes users hit a limit of 10 IPs but only the last quadrant of their IP changes. Does the pattern/style of IP change indicate the type of service they might be using to alter their IP? (Sometimes it's a combination of the third and fourth quadrant that changes.)
  • How can you determine if a user has a dynamic IP in a web application?
1
  • 3
    You have identified the problem with using IPs to identify the users. There isn't a way to solve this problem with IPs. This is what authentication mechanisms are for.
    – schroeder
    Mar 6, 2015 at 20:34

1 Answer 1

2

What is one of the best ways to determine whether or not a user is abusing IPs?

There's no good way, and it probably shouldn't be your goal.

The fact that you've been "tracking actively-used IP addresses for each user" means that you already have a tracking mechanism better than IP addresses that you should use instead.

As we've been tracking IPs, we notice that sometimes users hit a limit of 10 IPs but only the last quadrant of their IP changes. Does the pattern/style of IP change indicate the type of service they might be using to alter their IP? (Sometimes it's a combination of the third and fourth quadrant that changes.)

It suggests that they're staying in the same office, using the same coffeeshop, wandering around the same mall, connected to the same ISP but have changing addresses, or are using an anonymizing proxy provider (which one can do for legitimate reasons). Nothing bad or unusual about any of that.

How can you determine if a user has a dynamic IP in a web application?

If it changes, it's dynamic.

If it doesn't change, it might still be dynamic.

If it's static, it's not dynamic, but it still might change.

Client IP is not something you can reliably draw many conclusions about. Use authentication, use cookies, use client certificates, but don't use IPs to track anything about the endpoint.

You must log in to answer this question.