Detecting multiple forum accounts by IP

how to tell if it's the same person?

[paybacksa]

Is there a good way to tell with high probability that a poster is running multiple accounts on your forum?

I have posters with dynamic IPs. They come from the same network, but always a different IP. I suspect they are the same person, but don't want to suppose anything (I don't want to be wrong).

- No overlapping activity (but that's not rare)
- Same network (but different IPs)
- One IP is common to both (but that may simply be a dynamically-assigned IP from their ISP?)

Is there any good way to look into this?

[lorax]

I suppose you could also monitor browser type and machine to add another layer of (pseudo) fact.

[Sanenet]

On your login page, check to see if your id cookie exists - if it does, run a routine that sends you that id and the new username they login under.

If they're lazy (don't remove cookies before logging in as somebody else) then you should be able to catch them that way.

Course - could it be two people using the same machine? Husband & wife, or roommates?

[bakedjake]

Posting styles.

Many times, the IP isn't enough information. Read their posts - do they sound similiar? Do they always have the same MO? Many times, a person will always have a negative or positive opinion about something, or something they feel strongly about.

[rogerd]

Dynamic IPs are tough on admins. You can only guess so much about multiple accounts and problem users, and if it's a large ISP you can't block an IP range without messing up legitimate users.

Even static IPs aren't perfect. I've had siblings, spouses, parents/kids, roommates, dorm-mates, etc. post from the same IP and/or the same PC. When one is a troublemaker, that can be a problem. However, I've often had reassurances that if I reversed the IP block that the family unit or peer group would prevent future problems. This has usually worked out.

[bakedjake]

I almost forgot... Two more things you can use in addition to IPs:

User Agents
Cookies

[AAnnAArchy]

We use cookies on our board. I hate even saying this publicly, but I guess if someone is trying to be sneaky and is too dumb to dump their cookies, they won't be looking for this post either. Anyway, it's been a great help in getting rid of troublemakers on our board. Most of them have no idea how you figured out they were using more than one id. The Admins get a private message telling them which user names are duplicates. It isn't flawless, as we've gotten some false positives, but it's fairly easy to tell from profiles and writing style if they're the same person.

In general, IPs don't help because many of our users come from places like AOL or MSN. It's nice that the biggest troublemakers so far have had dedicated IPs though. :)

[MovingOnUp]

Ditto on the User Agent and Cookie suggestions.

Another thing to check is to do an NSLOOKUP on the IP Address. Often the name gives enough of a clue to let you know if it's a proxy or an end user.

Are there just two users on that IP address? Do you have address or phone information? If so, are they claiming to be from different areas? That's pretty unlikely. Are their emails with the same provider?

Lots of things to check.

[adamas]

If you are happy investigating any underlying database look for any users with the same password (or password hash). If so keep an eye on them and see if anything else corresponds.

[paybacksa]

thanks for the great suggestions. I am really wanting to avoid false positives, and want to automate this as much as possible. I'll see what I can come up with using theses tips.

[AAnnAArchy]

The false positives were very strange too - some of the people were in different countries...and I knew that they were different people.