> In my brief experience with abuse mitigation, connections coming from VPNs or unusual IP ranges were very significantly more likely to be associated with abus

> In my brief experience with abuse mitigation, connections coming from VPNs or unusual IP ranges were very significantly more likely to be associated with abuse. Correlating these factors with abuse implies that you already have methods of identifying abuse per se, independently of these factors. Is there no feasible way of just blocking the abuse itself when it begins, or developing much more proximate indicators to act on? > The worst offenders are Tor IP addresses. Anyone connecting from Tor was basically guaranteed to have bad intentions. Do you handle this by blocking known Tor exit node IPs entirely, or just adding hurdles to attempts to post from those IPs? > It’s tough for people who want these things for privacy, but the sad reality is that these same privacy protections are favored by people who are trying to abuse services. But naturally P(A|B) and P(B|A) are two different things.