Flag Suspicious Sign-Ups That Share IPs With Risky Accounts #49

New issue

Open

opened 2024-01-14 14:46:14 -06:00 by jimmyb · 0 comments

jimmyb commented

2024-01-14 14:46:14 -06:00

Owner

Problem

The original idea was to notify Discord whenever a new registration used an IP address that had already been used by another account. That is too broad on its own: shared networks, mobile carriers, VPNs, schools, workplaces, and household devices can all create legitimate IP reuse.

Instead, treat reused registration IPs as a moderation signal only when the match is higher risk.

Proposed Behavior

When a new user registers, compare the sign-up IP against existing users with the same IP address, excluding the newly created account.

Create a moderation/security alert only if at least one matching account is suspicious, such as:

banned = Y
user_deleted = Y
deleted_at is not null
multiple existing accounts share the same IP within a short recent window, if that data is easy to query

Do not alert for every ordinary reused IP match.

Alert Contents

The alert should include the newly registered account:

Username
IP address
Created at

For each matching risky account, include:

Username
Banned
User deleted
Created at
Updated at
Last activity date
Deleted at

Implementation Notes

The users table already stores registration IPs in ip_address.
Registration is handled by App\Actions\Fortify\CreateNewUser.
Prefer a structured internal audit/security event if that pattern exists by implementation time.
Discord is acceptable only as the delivery channel for high-signal alerts, not as the entire audit trail.

Acceptance Criteria

New registrations do not trigger an alert when the IP only matches normal active accounts.
New registrations trigger an alert when the IP matches at least one banned, user-deleted, or soft-deleted account.
The alert includes the new account and risky matching account details listed above.
Tests cover both the no-alert ordinary IP reuse path and the high-signal alert path.

## Problem The original idea was to notify Discord whenever a new registration used an IP address that had already been used by another account. That is too broad on its own: shared networks, mobile carriers, VPNs, schools, workplaces, and household devices can all create legitimate IP reuse. Instead, treat reused registration IPs as a moderation signal only when the match is higher risk. ## Proposed Behavior When a new user registers, compare the sign-up IP against existing users with the same IP address, excluding the newly created account. Create a moderation/security alert only if at least one matching account is suspicious, such as: - banned = Y - user_deleted = Y - deleted_at is not null - multiple existing accounts share the same IP within a short recent window, if that data is easy to query Do not alert for every ordinary reused IP match. ## Alert Contents The alert should include the newly registered account: - Username - IP address - Created at For each matching risky account, include: - Username - Banned - User deleted - Created at - Updated at - Last activity date - Deleted at ## Implementation Notes - The users table already stores registration IPs in ip_address. - Registration is handled by App\\Actions\\Fortify\\CreateNewUser. - Prefer a structured internal audit/security event if that pattern exists by implementation time. - Discord is acceptable only as the delivery channel for high-signal alerts, not as the entire audit trail. ## Acceptance Criteria - New registrations do not trigger an alert when the IP only matches normal active accounts. - New registrations trigger an alert when the IP matches at least one banned, user-deleted, or soft-deleted account. - The alert includes the new account and risky matching account details listed above. - Tests cover both the no-alert ordinary IP reuse path and the high-signal alert path.

jimmyb added the

type: feature

component: backend

component: internal notifications

labels

2024-01-14 14:46:14 -06:00

Codex changed title from ~~Add Discord Notification For New Account Sign-Ups From Previously Used IP~~ to Flag Suspicious Sign-Ups That Share IPs With Risky Accounts

2026-06-01 23:28:16 -05:00

jimmyb added this to the New Features - Part 1 project

2026-06-03 23:54:20 -05:00