How can I block an abusive person who endlessly tries to register more accounts?

Question

I have a free site with open registration; anyone can register and I am not able to change that. However, accounts must be approved by an administrator after completing a profile, so I have access to a variety of info to identify duplicate users (date of birth, "self introduction" comment, email address, photos, reported location in profile, geolocated IP, IP address, etc.)

Recently the site has become subject to the attacks of a single user who is extremely abusive and seems to have unlimited time to register multiple accounts. These accounts can be blocked relatively easily, but it's a lot of work for the administrator (me) and I'm afraid I will miss one among the legitimate accounts (this user registers about 6 accounts per day).

I have already:

• banned the user's known IP addresses
• blocked registration from known domains that are used for "disposable" email addresses
• added a special view to help me identify accounts based on known patterns of access from the user

Is there anything I can do with cookies, etc. to make it even more difficult for this user to register?

This is a Drupal 7 site.

EDIT: In my case, this is a human user, not a bot. But the bot answers are useful for those who are being specifically targeted by spammers.

Answer 1

Instead of trying to prevent the user from registering, which is a game for trolls and hackers alike, make the site annoying for him. Make him want to leave, as opposed to making him want to win the trolling game.

What I've done in the past, not specific to Drupal, is to let the user register. I then sabotaged his specific account:

1. I sprinkled if ($someuser) { sleep(rand($base, $base*2)) } in the code, where $base would increase daily. I made sure that he had lots of timeouts.
2. I would drop N% of his posts, where N started above 50% and only increased from there. If the post had certain keywords, it would be dropped immediately.
3. I would randomly drop CSS rules so the page would display poorly. Again, the severity would increase in time.

This required more effort on my part, but as per Sun Tzu's advice I was conditioning the user to hate my site. I wanted him to feel not that he was annoying us, but rather that he should be annoyed by the delays and apparent bugs. It took less than a week for him to give up on us.

EDIT: In the comments, user rooby mentions the Misery module which is based on the same concept:

1. Delay: Create a random-length delay, giving the appearance of a slow connection. (by default this happens 40% of the time)
2. White screen: Present the user with a white-screen. (by default this happens 10% of the time)
3. Wrong page: Redirect to a random URL in a predefined list. (by default this happens 0% of the time)
4. Random node: Redirect to a random node accessible by the user. (by default this happens 10% of the time)
5. 403 Access Denied: Present the user with an "Access Denied" error. (by default this happens 10% of the time)
6. 404 Not Found: Present the user with a "Not Found" error. (by default this happens 10% of the time)
7. Forms don't submit: Redirect back to the form during validation to prevent submission. (by default this happens 60% of the time) Note: Occasionally certain forms validate based on which button was pressed, this won't work in those cases.
8. Crash IE6: If the user is using Internet Explorer 6, this will crash their browser. (by default this happens 0% of the time)
9. Spam: Replace node content with a set word. (by default this happens 10% of the time)
10. Logout: Log the user out. (by default this happens 10% of the time)

Answer 2

Email The Abuser's ISP - They Will Put An End To It!

You have a log of his account creation times, and the IP addresses used to register, right? You also have a log of all of his harassing comments as well? Send these logs to their ISP.

You can find the ISP by doing an IP lookup either directly with ARIN at https://whois.arin.net/ui or another service which simply uses them for a whois. Most users will have an actual ISP come up for the owner of the IP, but some (large corporations typically) will own the IP themselves. Either way, you'll find out who it is that owns the IP, and from there you can look them up and get an abuse email address (sometimes they put an actual abuse email address in the WHOIS information, which is great) to send your email to. Be kind and courteous with the ISP. Don't write an epic novel - keep it simple. Something like, "This ip has been harassing myself and users of my website, please see the logs" will suffice. They see thousands of these a day, they don't want to read a sob story.

I used to be a Network Engineer at an ISP. We received countless harassment reports for this very kind of behavior. The moment a subscriber receives the phone call, they stop about 90% of the time. If it does continue, legal action can ensue which means most ISPs take very serious action.

Your aggressor is probably a kid living at home with his parents, which means when his parents' internet account is threatened to be terminated, they'll be incredibly upset with him for his behavior.

I've personally taken this route and it does work, even if the aggressor is not in your country. ISPs do NOT take kindly to users being abusive on their network.

Side Note

There's the possibility he is using a Proxy. However, it is very unlikely he used a proxy upon initial registration unless he fully intended (from the moment he registered) to troll on your website. If none of the IPs actually point to a legitimate ISP where you can actually send an abuse email, try sending it to whatever Proxy service he's using.

People have this crazy idea that simply because someone's using a Proxy, they're undetectable. That's false. Proxy services typically follow the same rules everyone else does (of course there are exceptions). When they get an abuse report, they take care of it just like an ISP does.

On the incredibly small chance that this user is behind a Proxy that doesn't play nice, I'd follow the advice of the other answerers. Seriously though, that's so rare that most website owners will never see an attack from someone who's seemingly "undetectable".

Answer 3

On your question, you do not mention having a Captcha. Perhaps, this anoying user is a bot? My guess is that you already have a captcha and that user is actually human.

But... if that's not the case, I would recommend:

reCAPTCHA

Uses the Google reCAPTCHA web service to improve the CAPTCHA system and protect email addresses.

Answer 4

Hellban / shadowban

As blocking a person from creating new accounts to replace blocked ones is nearly impossible, a somewhat popular solution to this problem is the so-called hellban (http://www.urbandictionary.com/define.php?term=hellban) or shadowban, where you implement a feature that isolates certain accounts from everyone else without making it obvious that they have been banned.

For example, you would make sure that they feel like their experience is genuine and they can keep using the same accounts, but make a condition that any of their posts or activities are visible only to hellbanned accounts and any accounts (or not-logged-in situations) that share IP and/or cookies with the hellbanned account. If the user continues to troll but gets no response, then they will leave eventually.

Answer 5

At No Sssweat's suggestion, I'm putting this as an answer instead of a comment so more people see it.

Drupal.org/project/misery does quite a good job of annoying the crap out of a user with about eight different methods. Random time outs, log outs, random redirects etc. and the frequency is changeable.

An easy version of dotancohen's nice write up to the problem.

Answer 6

How about using a second factor? In your registration, say you'll send an SMS to their phone or an email and ask they confirm their registration by clicking a link and sending the info back. You'll acquire a harder to spoof identifier than IP address and it may be easier to filter him out that way. Obviously will require some small amount of scripting...

Answer 7

It is actually impossible.

You cannot stop a person from registering again and again. The only thing you can do is harden the registration process and double/triple-checking their ID (through email address and google account and facebook account and LinkedIn account and phone number, and so on) and correlate each person with a specific ID that aggregate all these details.

The specific person can either pick another network through web proxy, create many @email, open several facebook/google/LinkedIn account and so on, but you will never be able to stop this person to register again (unless you check its DNA).

Your only choice is to harden the registration process.

Answer 8

As suggested by No Sssweat, you can use reCAPTCHA. But if incase you don't want to annoy legitimate users, then you can try Honeypot module. It gives the option of having an extra field which shouldn't be filled (AFAIK bots may fill all fields) or have time restriction.

Documentation reads as,

Honeypot uses both the honeypot and timestamp methods of deterring spam bots from completing forms on your Drupal site (read more here). These methods are effective against many spam bots, and are not as intrusive as CAPTCHAs or other methods which punish the user [YouTube].

Another option is Spambot module, it prevents spam by verifying registration attempts against the Stop Forum Spam.

Spambot protects the user registration form from spammers and spambots by verifying registration attempts against the Stop Forum Spam (www.stopforumspam.com) online database. It also adds some useful features to help deal with spam accounts.

Answer 9

There is an answer to the question - albeit that the community may find this offensive. I don't know why, save cost, that the path has not been taken more often.

Send a cease and desist letter to the individual who is trespassing on your site, and who is violation Title XVIII of the US Code, Tampering with Computers, Fraud and Abuse.

If they don't cease, pony up the cash and sue. In the mid 1990's I had the first case in the WDMO where the sole ISP for the Kansas City area was hacked by 3 teens. I contacted the families (they had rooted one of the servers and were stupid enough to store their application to join "Warez" groups with their real names and addresses in a hidden subdirectory) and asked them to stop the adolescent boys from doing this. They refused.

In a 54 page complaint I had to explain: ISPs, Internet, exceeding access, etc. to a newly appointed judge.

I was more than an advocate, an account of mine had been accessed (thank god, not a client account - The Rust List) and I was ticked off. I charged the parents (only way to go where defendants were minors in a civil action) and stated that the parents had placed a dangerous instrumentality into the hands of minors without adequate supervision and that the minors had engaged in the transfer of stolen software, and kiddie porn (Yep, 16 year old boys taking pictures of their 16 year old GF's is "kiddie porn"). I hit the homeowner's policies and I had a remedy that the courts in those days would not even consider: a lifetime ban on the use of computers for the teenagers.

It got settled within a week of the transfer of discovery.

You have tried everything else: hammer this little shit with a walletectomy. Be careful to pick an attorney who knows what this is and not one associated with a "big firm" where you will be billed to death.

Consider how a court order precluding the jerk from accessing your site might work: S/He's banned - you find an IP address of his/her violating the Court Order - send it to your attorney and s/he files a motion with the Court showing violation of the Order and the Court will respond with a Show Cause Order why the defendant should not be held in contempt of court.

An attack from other sites/IP addresses start coming in - tell your counsel - and the response can include mirroring the defendants computers, an injunction stopping the defendant from all access to the Internet, and, upon finding that the defendant violated the order by proxy, the Court will impose sanctions.

Ultimately, the jerk may have confined himself to forever be blocked from the Internet. If you are truly pissed off after all of this and you want to be certain that the defendant is off the Internet, hire a PI to follow the defendant for a week or ten days (not cheap) and if s/he is accessing the Internet from a Starbucks - or McD's you have them: back to the judge.

The ultimate Order is beyond belief and will only happen with overwhelming evidence that the defendant had routinely violated the court's orders: no smart phones, no VOIP, no cable or sat TV (Internet is available and s/he has shown a total disregard for the law, so nothing that they can hack to gain access is permitted), no Internet (it would be nice if it were a lifetime ban - likely not), no Internet of things, and ultimately, no computing devices.

If the defendant was making their living in the tech sector - they have ditches to dig and burgers to flip.

That's how to end this with the nuclear option.

Answer 10

I like the misery model, but I would add to randomly send him to a page with really loud annoying messages and other times send him to really bad porn sites. Anything that might get him in trouble or embarrassed if he is in public.

Answer 11

I have written a module specifically for this kind of situations. It is called Spaces Enforced and can be found here, and works by blocking any registering person whose name doesn't contain at least 1 space. It can be further configured and you can select what character needs to appear how many times. It also has a succession rate of close to 100%

Answer 12

Disable registration form /user login page Account Settings - /admin/config/people/accounts -> under Who can register accounts?, check only admin