I have a user that has gotten 10 refferals to my website in the last 10 hours or so. All the users he reffered has done the same things and have only logged on once so far. The IP address is very similar to all of his referals, lets say the ip is 111.11.111.22 the refferals have all of the 1's in common with one another? the 2's are not the same. Is this all the same person? how should I handle it, ban him/her right away?
maybe himself doing it on his own network, unless he lives in a small country and his telling his direct friends to sign up
Yep, he is scamming you, or he got 10 friends to sign up at his house. Another possibility is that maybe he got friends/coworkers from his office/school, and then the IP is the same. Try scaring him: e-mail him saying that your "sophisticated scam detection software's algorithm detected it and that you will take legal action against him as per your TOS" or something. If he is submitting fake referrals: he will most likely back off and get scared, unless he is smart enough (which he obviously isn't, since he should hsve at least used a proxy. If these are genuine referrals, he will probably try to explain.
Ok, thanks. If there is no reply and he is getting more referrals in the same way I'll ban him. If he answers....well, I'll see what he has to say? Yes, I am giving something for referrals and there is a 2 day waiting period to make sure that I can review referrals and make sure its not a scam.
Well, it's just another step. A smart scammer may make something up. However, I don't think he thinks smart, because any other experienced scammer would know that you can see the IP's... Hear what he has to say. Maybe continue pressuring him one more time to see what happens.
Well I didn't tell him how it found him, did i? There are some other things that made him stand out as a scammer. usernames like: nkfldwj lol
Sounds like a small range of IPs assigned to say a company / school / college. Like you have been advised already, drop him a line and see what he comes back with - your system flagged the activity as suspicious etc....may make him think twice of doing it again if there is a chance something is watching him.