[Zxin]

Over a 10 minute period of time you get http requests from 3 or 4 different IP addresses, I think that most people would say that is worth looking in to, so then FLAG the account.

Let me be specific that the requests contiune over the time period,
not IP1 for 10 munites then IP2 then IP3 then IP4, but a mix of requests.

A simple whois to check if the IP block belongs to the same ISP and then you KNOW its being shared (especially if you are talking saw east coast and westcoast IPs). (This can be done with a nightly cron job, or even on the fly depending on severity thesholds)

Quite possible to detect, since you are using authenticated access.
Remember its not that an account "changes" IPs its simultaneous requests.
A user with 10 requests per minute over 2 IP addresses for 10 minutes sure the heck IS sharing accounts (unless the ISP has some real elaborate load sharing proxy, but in this case you can rely on whois lookups)

1. VBB detects more than X IP addresses per username in an X seconds, and flags the account.
2. Log parcer kicks in for flagged accounts and strips out username/IP data and does a whois and checks for IP ownership, and outputs an email address to the forums staff (keeps false positives down)
3. Automated step via theshold that says if X IPs in X hours (and whois data not matching) and starts actions placed in the plugin (admin can set anywhere from flag and email to shutdown the account (heck lauch a nuke if you have that kind of access :P)

-Zxin

Originally Posted by Andreas

That's what I always tried to point out: You cannot detect if an account is being shared, you can only assume it, and this assumption might be good or bad, depending on your algortihms.