> this worked for a little bit longer, but he proceeded to get on a VPN, and then another when i blocked that IP, then another when i blocked that IP, etc, etc.

> this worked for a little bit longer, but he proceeded to get on a VPN, and then another when i blocked that IP, then another when i blocked that IP, etc, etc. Beyond VPNs, I've even seen attackers leverage residential IP networks which makes VPN detection ineffective as well [1]. If you ever need a more permanent identifier to ban users on, consider using a device/browser fingerprinting tool [2]. It helps avoid the whack-a-mole issue of more sophisticated attackers churning IPs/emails/user agents/etc. [1] https://brightdata.com/proxy-types/residential-proxies https://brightdata.com/proxy-types/residential-proxies [2] https://stytch.com/products/device-fingerprinting https://stytch.com/products/device-fingerprinting (I'm admittedly biased towards our solution as I work at Stytch)