Ban evasion and re-registration in Classifieds marketplaces

How the attack works

1. After an account restriction, the operator returns to the registration route with replacement contact details, aiming to establish a profile that appears unrelated to the removed account.
2. New sessions and networks are used to separate the registration from the earlier activity, while the client environment may also be changed or disguised.
3. The new account resumes posting or contacting users, often returning to the same categories and actions that produced the original reports.
4. Where the service sells adverts or listing upgrades, payment details may be reused or changed as the operator tries to continue participating.
5. Moderators receive another report and must decide whether the new activity is connected to an earlier restriction or represents a separate user requiring independent review.

Why it gets through

An account ban removes a profile, but the operator may still return. If a fresh email address or phone number dominates the next registration review, earlier activity can disappear from view. The business repeats enforcement as another cycle of adverts and reports begins.

Repeated abuse can cross several changes at once: account name, session, network and client presentation. No single identifier gives a complete or permanent answer. A useful investigation looks for relationships in the context that remains available, then compares those relationships with the earlier moderation decision rather than assuming that a new account is either certainly independent or certainly the same person.

There are legitimate reasons for related registrations. Households share devices, businesses change staff and users can return after an appeal or an authorised account replacement. Your restriction history and reinstatement rules therefore matter. Linking requests helps investigators decide what to examine, but a matching signal should not silently become a permanent exclusion for everyone connected to a device or network.

Moderation cost per investigation rises when analysts reread reports and reconstruct activity that a colleague has already examined under another account. That work reduces capacity for difficult cases. Account removals may look productive while the same operation continues through replacements, so the business needs to understand the effort spent returning to a previously investigated pattern.

The repeat-offender rate helps assess whether restrictions address recurring operations or only their latest visible profiles. Users who report the same approach again may lose confidence in reporting, even when each account was removed promptly. Measure recurrence using the moderation evidence available, rather than treating every suspected device relationship as a confirmed returning offender.

The successful appeal rate can expose the cost of restrictions that are too broad. Shared devices or legitimate business environments may connect an innocent user to an earlier account without establishing wrongdoing. Review reinstated accounts and the reasons for those decisions alongside repeat abuse, so reducing recurrence does not become a reason to disregard evidence that a restriction was mistaken.