With the cheap availability of "residential proxies", which are mostly people's homes computers who are either compromised and part of a botnet, or where people installed adware which runs a proxy, our traditional IP-based throttling of actions is becoming easier and easier to circumvent.
I propose we start creating a new class of throttling of critical actions (edits, account creations, ...) that allows us to limit/block actions based on the reputation of an IP.
So basically:
- when checking if the user can perform an action, check the reputation of their IP with our ip reputation provider service, Ipoid
- If we get a non-empty response within a short timeout (2 seconds), and the IP is part of a residential/callback proxy network, count it towards a special throttling rule counter dedicated to those
- Otherwise apply our normal throttling
We should probably begin applying this to account creation specifically, but the mechanism should probably be more general.