Multi-Accounting Detection: Identifying Duplicate Accounts Across Shared Networks

Multi-accounting poses a significant challenge across various online platforms, from e-commerce and gaming to financial services. It undermines fair use policies, facilitates fraud, and skews analytics. While individual user attributes like email addresses or device IDs are often used for detection, these are readily circumvented. A more robust approach involves analyzing network-level signals, particularly when multiple accounts originate from, or route through, shared network infrastructure.

This article outlines technical strategies for identifying multi-accounting by scrutinizing shared network characteristics, distinguishing between legitimate and suspicious activity.

The Problem: Obfuscation Through Shared Infrastructure

Adversaries creating multiple accounts often attempt to mask their true origin. They leverage several types of shared network infrastructure to achieve this:

• Public Proxies/VPNs: Common tools for IP address rotation and obfuscation.
• TOR Exits: Anonymity networks that route traffic through multiple relays, emerging from an exit node shared by many users.
• Residential Proxies: IPs assigned to home users, but controlled by a proxy service. These are particularly challenging due to their legitimate-appearing nature.
• Datacenter IPs: Non-residential IPs often used for hosting, cloud services, or large-scale automation. While legitimate for some applications, their presence can be a red flag for individual user accounts.
• Shared WiFi Networks: Public hotspots, corporate networks, or educational institutions where many legitimate users share a single external IP address.

The objective is to differentiate between benign shared IP usage (e.g., a family member using a streaming service) and malicious multi-accounting (e.g., an individual creating dozens of accounts for illicit purposes).

Network Signals for Multi-Accounting Detection

Effective detection hinges on correlating diverse network signals and understanding their context. Here are key indicators to monitor:

1. IP Type and Classification

Categorizing an IP address is foundational. An IP intelligence API can classify an IP as:

• Proxy/VPN: Explicitly identifies if an IP belongs to a known proxy or VPN provider. This is a strong indicator of an attempt to mask origin.
• TOR Exit: Indicates traffic emerging from the TOR network. While not inherently malicious, it's a high-risk signal due to its anonymity features.
• Datacenter: An IP from a hosting provider or cloud service. Legitimate users rarely access consumer services directly from datacenter IPs.
• Residential: Generally considered low-risk, but residential proxies complicate this. Further analysis is required.

Accounts registering or logging in consistently from proxy, VPN, or datacenter IPs should be flagged. The key is patterns: multiple distinct accounts, all originating from or consistently switching between these high-risk IP types, are highly suspicious.

2. Autonomous System Number (ASN) and Organization

An ASN identifies a network within the internet routing system. Analyzing the ASN and its associated organization can reveal patterns:

• ASN Diversity vs. Homogeneity: If multiple accounts are created from IPs belonging to a wide variety of ASNs (especially residential ones), it might be legitimate diverse user base. However, if many seemingly unrelated accounts originate from IPs under the same single ASN known for hosting proxies or VPNs, that's a strong indicator.
• ISP Reputation: Some ISPs are known to be more tolerant of abuse or actively operate services popular with fraudsters (e.g., bulletproof hosting). Flagging accounts originating from these ASNs is a proactive measure.

3. Reverse DNS (rDNS) Hostname

rDNS resolves an IP address back to its domain name. This can provide valuable context:

• Generic Hostnames: rDNS hostnames like dsl-123-45-67-89.ispname.net are typical for residential users. Accounts originating from these are usually lower risk, assuming other signals are clean.
• Suspicious Hostnames: Hostnames containing keywords like proxy, vpn, tor, cloud, vps, server, or highly generic machine names (e.g., ec2-xx-xx-xx-xx.compute-1.amazonaws.com) are strong indicators of non-residential or obfuscated traffic.
• Lack of rDNS: A complete absence of rDNS record, especially for an IPv4 address, can sometimes be a subtle flag, as many legitimate residential and business ISPs configure them.

4. IP Risk Score

Many IP intelligence services provide a numerical risk score. This score aggregates multiple factors (e.g., blacklists, known malicious activity, frequency of abuse reports, presence on TOR exit lists, proxy detection) into a single, actionable metric.

• Thresholding: Establish a risk score threshold. Accounts interacting with your platform from IPs exceeding this threshold warrant closer inspection.
• Aggregate Risk: If multiple accounts, despite having different IP addresses, consistently exhibit high-risk scores, it suggests a coordinated effort by an adversary using various compromised or purchased high-risk IPs.

5. Geo-Location Inconsistencies

While not directly about shared networks, geographic data complements network signals:

• Impossible Travel: An account logging in from City A, then two hours later from City B thousands of miles away, is suspicious. Correlate this with IP type; if the IP in City B is a VPN, it's highly suspect.
• Network-Level Geo Discrepancy: If the claimed user location is incongruent with the IP's inferred datacenter location. For example, a user claiming to be in London but connecting through a datacenter IP in Frankfurt.

Strategies for Implementation

Integrating these signals requires a layered approach:

• Baseline Legitimate Activity: Understand the typical IP characteristics of your legitimate user base. What percentage uses mobile data, residential broadband, corporate VPNs? This baseline helps identify anomalies.
• Real-Time API Integration: Integrate an IP intelligence API at critical junctures (e.g., account registration, login, high-value transactions). This allows for immediate assessment of incoming IP addresses.
• Correlation Engine: Develop or utilize a system that can correlate events across multiple accounts. For instance, identify when 10 new accounts are registered within an hour, all from distinct IPs but sharing the same ASN identified as a proxy provider, or all having risk scores above a set threshold.
• Actionable Tiers: Define escalating responses based on risk. A low-risk flag might trigger an CAPTCHA, a medium-risk flag might require multi-factor authentication, and a high-risk flag might lead to account review or immediate blocking.

Example Scenario:

A streaming service notices a pattern: over 50 new accounts are registered in a week. Each account uses a distinct IP address. However, an analysis of the IP intelligence data reveals:

• All 50 IPs are classified as 'datacenter' or 'VPN exit'.
• The ASNs for 40 of these IPs belong to two well-known cloud hosting providers.
• The rDNS hostnames consistently include terms like vps, server, or cloud.
• The average IP risk score for these IPs is significantly higher than the platform's baseline for new registrations.
• Despite geographically diverse IP locations, all accounts register using similar naming conventions or email address patterns.

This confluence of signals strongly indicates coordinated multi-accounting, allowing the platform to flag and investigate these accounts much more efficiently than relying solely on individual account attributes.

Limitations and Considerations

• False Positives: Legitimate shared networks (e.g., large universities, corporate networks) can trigger flags. Granular analysis, understanding your user base, and leveraging multiple signals (e.g., not just IP type but also ASN reputation, risk score) mitigate this.
• Residential Proxies: These remain challenging. While they appear residential, their programmatic use often generates behavioral anomalies that, when combined with IP intelligence, can still expose them.
• Evolving Tactics: Adversaries constantly adapt. Continuous monitoring of emerging proxy services and network abuse patterns is crucial.

Conclusion

Multi-accounting detection requires moving beyond individual account attributes to embrace robust network-level intelligence. By leveraging IP classification, ASN analysis, rDNS, and comprehensive risk scoring, organizations can significantly improve their ability to spot duplicate accounts operating across shared and obfuscated networks.

Guarda.net has run over 0 lookups, providing detailed IP intelligence to help engineers like us build more resilient systems. You can try a free IP check on the homepage to see the kind of data available.