Register for our next deep dive! Who is Behind Portal Kombat? Exposing the Pravda Disinformation Machine with OSINT on Thursday, June 27, 2024, at 16:00 CET. Grab your spot now! close
22 Jan 2024

Fighting Ban Evasion with Maltego

Maltego Team

Ban evasion has been affecting businesses since the first online platforms and digital products were launched, and it shows no signs of diminishing. In addition to undermining the integrity and enforceability of a platform’s rules and policies, ban evasion contributes to a less secure and less trustworthy environment for users and advertisers alike.

But are all industries equally affected and vulnerable? How can ineffective handling of ban evasion impact your business, and what are effective strategies to combat ban evaders? Finally, how does Maltego help in tackling ban evasion? These are some of the questions we will explore in this article.

Industries Particularly Affected by Ban Evasion πŸ”—︎

Ban evasion occurs when individuals or organizations bypass restrictions meant to block them from a platform or service. Banning users and restricting the use of a platform’s services through multiple accounts is often used as a tool by platforms to prevent product abuse. At times, this may involve egregious violations such as spreading illegal content, while at other times, it may be due to violations of policies like signing up for multiple accounts or abusing promotions and coupons.

Ban evasion is a problem across various sectors, but it mostly affects three areas: social media platforms, online sales, and financial services.

Here are typical examples of how ban evasion manifests in these industries:

1. Social Media Platforms

Banned users often create new accounts using alternate login credentials, especially if they were previously banned for reasons like spreading hate speech or misinformation.

They commonly use VPNs or proxy servers to alter their IP addresses and evade detection, enabling them to set up new accounts. There may be situations when platforms ban a range of IP addresses or unique network identifiers when there is known suspicious activity such as bot networks.

Some users may also resort to tweaking their personal information, such as altering their names, dates of birth, or even profile pictures, as a means to slip past detection measures and continue using the platform.

2. Online Sales

Similarly, sellers whose accounts were banned for fraudulent activities or selling counterfeit products often return to the same platforms by creating new user profiles. There are those who go to the extent of managing multiple accounts under various aliases, effectively dodging detection.

They frequently change their contact and payment information and even their physical addresses. Some sellers also employ IP-masking tools and services to further obscure their activities.

There’s also a tendency to engage in feedback manipulation, where sellers create fake buyer accounts to purchase their own products, deceitfully boosting their review scores. This manipulation can easily mislead genuine buyers who often trust these ratings, leading them to believe in a falsely earned reputation on the platform.

3. Financial Services

Within the financial services sector, ban evasion takes on a more complex form. Individuals or companies previously banned for fraudulent activities might attempt to access services again under different business names. This tactic is particularly prevalent among those who are currently under sanctions.

Ban evaders are also known for creating and using shell companies to open new accounts or carry out transactions. Through this practice, they manage to conceal the identities of the actual account holders who have been banned.

Lastly, legitimate accounts are sometimes hijacked through identity theft or social engineering, which are then used to circumvent personal bans. These strategies highlight the extent to which individuals or entire organizations will go to bypass restrictions in the financial sector.

If you have observed instances of ban evasion on your product or platform, you can use your internal data in Maltego to prevent new ban evaders or tackle existing ones. You will find out how to do this in the final section of this article. Click the button below to discover the steps now.

Impact of Ban Evasion on Your Business and Platform πŸ”—︎

The effects of mishandling ban evasion or failing to act decisively can be broadly categorized into two main areas: platform health and business impact.

Platform Health πŸ”—︎

  1. Influx of Inappropriate Content: When ban evaders return, they often bring along content that violates platform guidelines. From mildly offensive to outright illegal material, this content compromises the integrity and safety of the platform.
  2. Loss of Trust: If harmful activity continues and inappropriate content circulates on the platform, user trust erodes, a value that is difficult to restore.

Business Impact πŸ”—︎

  1. Decline in Genuine User Engagement: A drop in activity from genuine users as a result of the unpleasant environment created by the continuous harmful activity and fake or inappropriate content. This decline in engagement can also lead to a decrease in valuable user-generated content.
  2. Increased Incidence of Fraud: Particularly in online sales and the financial sector, ban evasion may lead to a rise in fraudulent activities and direct financial losses. For example, online sales platforms may suffer from fraudulent transactions, while financial services might face unauthorized access to sensitive financial data.
  3. Legal and Regulatory Consequences: In the heavily regulated financial sector, failure to effectively manage ban evasion can lead to hefty fines and legal compliance issues. Non-compliance with regulatory standards can tarnish the reputation of the institution and lead to long-term trust issues with clients and regulators.
  4. Loss of Advertisement Revenue: Advertisers prefer to associate their brand with safe and reputable platforms. If a platform is perceived as poorly managed or unsafe, advertisers may pull out and cause losses in revenue.

Strategies to Fight Ban Evaders πŸ”—︎

The two most impactful strategies your team can follow to fight ban evaders are:

User Data Analysis πŸ”—︎

As part of the sign-up and access process, platforms collect the identity data of users as well as other data such as browser-agent data, IP addresses, device identifiers, and unique cookies. These data points allow platforms to make inferences about ban evaders who change some of these characteristics to bypass registration controls.

Even seemingly uninteresting data, such as account creation time, can help make these inferences. For example, analyzing the time elapsed between a ban and the creation of a new account can provide insights. However, in thousands of lines of records, it is often not straightforward to make connections. In the demo example presented below, we will show how to address this challenge in Maltego, using the different user data points just explained.

Manual or Automated Pattern Analysis πŸ”—︎

Through manual investigative work in more advanced and complicated cases, platforms employ user reviews not just on their platform but on the same actor’s behavior across other accounts as well, to identify whether they are ban evaders.

In doing this, platforms often use techniques such as social network analysis to identify intersecting connections, reposting the same or similar content, causing coordinated harm, and other. Platforms also focus on looking for violations of the policy for which a user was banned in the first place.

Steps in Fighting Ban Evasion with Maltego πŸ”—︎

To put these strategies into practice, and even automate some parts for better and quicker response, your team can investigate ban evaders in Maltego.

Your first step would be to import internal data directly into Maltego where you will be able to visualize networks and look for connections between ban evaders on your graph.

To find out how to create your first Maltego graph, check out this step-by-step guide on our blog.

In fighting ban evaders, one of the ways of combatting ban evasion effectively is to figure out the real identity behind the person setting up the accounts or discern a common pattern of behavior. Maltego enables investigators to do so with its access to reputable breach data and dark web investigative capabilities, all done in a safe and anonymous environment.

To understand the steps needed, we will now mimic a potential platform and ban evaders to illustrate a short investigation in Maltego. For the convenience of referencing our example, we will name this fictitious platform β€˜XYZ.’ We will use canned data and a set of custom Transforms that you can easily build within the tool to show you how it all looks and gets connected.

Check the Maltego documentation to learn how to import data into and export data from Maltego, and generate reports.

To understand the steps needed, we will now fabricate a potential platform and ban evaders to illustrate a short investigation in Maltego.

Maltego in Practice πŸ”—︎

As the first step, we will paste a number of accounts from our internal database. These are accounts that recently signed up to the XYZ platform. Our aim is to investigate them to see whether and how they are connected.

We will run a local Transform To user [BannedUser], specifically designed for this investigation. It will retrieve User Entities on the XYZ platform that come from the previously imported database. This will be the first step towards visualizing static data points in a graph.

Learn how to write your Maltego integrations to fully customize your investigations.

What all the User Entities have in common are logins, or in other words, records indicating the details of when they logged in, on what device, using which browser, or even the operating system. This is precisely the kind of data we want to extract.

The custom To login [BannedUser] Transform populated our graph with numerous logins, or in other words, records of every time a user has logged in.

Every application or platform keeps track of this data, and you can take advantage of it in investigations like this one.

Depending on the range of results you have initially set up, your graph will display from a few login data points to hundreds of logins.

Once you open the Login Entity in your Maltego, you will see, among other things, information about the device language, time of login, device type, login IP, login ID, browser, operating system, and screen resolution – all valuable data points that will help us determine whether these accounts are connected.


If you find a list of users with the same properties, but who, for example, logged in 2 minutes after they were banned from a different account, this gives you a good reason to assume they’re connected, and you should investigate further. That is an interesting direction to take but also difficult to execute if you can only rely on manual means.

However, we do not want to spend hours combing through the data and opening each login, as this would take time and, in the meantime, the ban evaders might be causing more damage. For this reason, Maltego provides the advantage of selecting all the data points and searching through them automatically using dedicated custom Transforms.

For this investigation, we will run the To Device ID Transform, and see how these different Login Entities are connected.

You can observe that Maltego retrieved a unique hash connected to over 250 Login Entities. This means that all these users connect from the same device, a strong indicator that you are dealing with the same individual.

Maltego Use Cases for Protecting Your Brand and Product Integrity πŸ”—︎

Fighting ban evasion is just one of the many use cases that Maltego can serve. It’s a pre-built tool used by analysts from teams like Risk Management, Fraud Detection, Digital Security, and Trust and Safety that deal with:

As each platform and product is different, the challenges faced by fraud and security teams also vary. However, the core use of Maltego remains the same: accelerating and simplifying investigations through link analysis with easy internal and external data integrations.

Without Maltego, it would take much longer to conduct investigations, and the chances of following the wrong leads would increase drastically. Essentially, Maltego displays only what is relevant. Instead of stifling through mountains of data, the data relationships are painted on the Maltego graph. With the time saved, we can investigate deeper into the assets and currency laundering before the assets actually land in the players’ wallets.

Maksym Gryshchenko πŸ”—︎

CCP Games Security Team πŸ”—︎

If you want to discover a real-life story of how one security team used Maltego to suspend over 90,000 malicious user accounts, check out our case study below. You will learn how the CCP Games company deployed Maltego to become the go-to tool they use to detect and identify in-game fraud.

You can download your free copy now:

Download the resource

DE +49
Albania +355
Algeria +213
Andorra +376
Angola +244
Anguilla +1264
Antigua And Barbuda +1268
Argentina +54
Armenia +374
Aruba +297
Australia +61
Austria +43
Azerbaijan +994
Bahamas +1242
Bahrain +973
Bangladesh +880
Barbados +1246
Belarus +375
Belgium +32
Belize +501
Benin +229
Bermuda +1441
Bhutan +975
Bolivia +591
Bosnia and Herzegovina +387
Botswana +267
Brazil +55
Brunei Darussalam +673
Bulgaria +359
Burkina Faso +226
Burundi +257
Cambodia +855
Cameroon +237
Canada +1
Cape Verde +238
Cayman Islands +1345
Central African Republic +236
Chile +56
China +86
Cote d'Ivoire +225
Colombia +57
Comoros +269
Congo +242
Cook Islands +682
Costa Rica +506
Croatia +385
Cuba +53
Cyprus +90392
Czech Republic +42
Denmark +45
Djibouti +253
Dominica +1809
Dominican Republic +1809
Ecuador +593
Egypt +20
El Salvador +503
Equatorial Guinea +240
Eritrea +291
Estonia +372
Ethiopia +251
Falkland Islands (Malvinas) +500
Faroe Islands +298
Fiji +679
Finland +358
France +33
French Guiana +594
French Polynesia +689
Gabon +241
Gambia +220
Georgia +7880
Germany +49
Ghana +233
Gibraltar +350
Greece +30
Greenland +299
Grenada +1473
Guadeloupe +590
Guam +671
Guatemala +502
Guinea +224
Guinea-Bissau +245
Guyana +592
Haiti +509
Honduras +504
Hong Kong +852
Hungary +36
Iceland +354
India +91
Indonesia +62
Iran, Islamic Republic of +98
Iraq +964
Ireland +353
Israel +972
Italy +39
Jamaica +1876
Japan +81
Jordan +962
Kazakhstan +7
Kenya +254
Kiribati +686
Korea, Democratic People's Republic of +850
Korea, Republic of +82
Kuwait +965
Kyrgyzstan +996
Lao People's Democratic Republic +856
Latvia +371
Lebanon +961
Lesotho +266
Liberia +231
Libyan Arab Jamahiriya +218
Liechtenstein +417
Lithuania +370
Luxembourg +352
Macao +853
Macedonia, the former Yugoslav Republic of +389
Madagascar +261
Malawi +265
Malaysia +60
Maldives +960
Mali +223
Malta +356
Marshall Islands +692
Martinique +596
Mauritania +222
Mauritius +230
Mayotte +269
Mexico +52
Micronesia, Federated States of +691
Moldova, Republic of +373
Monaco +377
Mongolia +976
Montserrat +1664
Morocco +212
Mozambique +258
Myanmar +95
Namibia +264
Nauru +674
Nepal +977
Netherlands +31
New Caledonia +687
New Zealand +64
Nicaragua +505
Niger +227
Nigeria +234
Niue +683
Norfolk Island +672
Northern Mariana Islands +670
Norway +47
Oman +968
Pakistan +92
Palau +680
Panama +507
Papua New Guinea +675
Paraguay +595
Peru +51
Philippines +63
Poland +48
Portugal +351
Puerto Rico +1787
Qatar +974
Reunion +262
Romania +40
Russian Federation +7
Rwanda +250
San Marino +378
Sao Tome and Principe +239
Saudi Arabia +966
Senegal +221
Serbia +381
Seychelles +248
Sierra Leone +232
Singapore +65
Slovakia +421
Slovenia +386
Solomon Islands +677
Somalia +252
South Africa +27
Spain +34
Sri Lanka +94
Saint Helena +290
Saint Kitts and Nevis +1869
Saint Lucia +1758
Sudan +249
Suriname +597
Swaziland +268
Sweden +46
Switzerland +41
Syrian Arab Republic +963
Taiwan +886
Tajikistan +7
Thailand +66
Togo +228
Tonga +676
Trinidad and Tobago +1868
Tunisia +216
Turkey +90
Turkmenistan +993
Turks and Caicos Islands +1649
Tuvalu +688
Uganda +256
United Kingdom +44
Ukraine +380
United Arab Emirates +971
Uruguay +598
United States +1
Uzbekistan +7
Vanuatu +678
Holy See (Vatican City State) +379
Venezuela +58
Viet Nam +84
Virgin Islands, British +84
Virgin Islands, U.S. +84
Wallis and Futuna +681
Yemen +967
Zambia +260
Zimbabwe +263

By clicking on "Access", you agree to the processing of the data you entered and you allow us to contact you for the purpose selected in the form. For further information, see our Data Privacy Policy.

On our blog, you can also read more about product and platform abuse or check out how to further automate your investigations by using Maltego Machines with our step-by-step guide.

Don’t forget to follow us on Twitter, LinkedIn, and Mastodon, and sign up to our email newsletter, so you don’t miss out on updates and news!

Happy investigating!

By clicking on "Subscribe", you agree to the processing of the data you entered and you allow us to contact you for the purpose selected in the form. For further information, see our Data Privacy Policy.