A warm welcome. Thirty-two times.
Separate shared infrastructure from evidence of misuse.
A fictional subscription service offers one welcome credit per eligible person. Thirty-two new accounts claim the credit in one hour. Several share an IP address. Your job is to decide what needs review, not to infer a person’s identity from a network address.
Fictional scenario · Synthetic data · No real customer records- new accounts
- 32
- claim window
- 1 hour
- welcome credit
- €10
What would
you look at?
Open at least two files before making a decision. You can read every file.
0 of 3 files opened
A useful definition01 / Connection summaryNetwork context+
Twenty accounts share an IP belonging to a university residence. Their sign-ups span different devices and times. Shared internet access is a plausible explanation. No individual identity verification has been completed.
A shared IP can connect unrelated people. Treat it as context, not proof of a policy breach.
02 / Behaviour reviewRedemption sequence+
A separate group of twelve accounts uses two device references and repeats the same short sequence from registration to credit redemption. Activity is tightly clustered. The records suggest coordination but do not establish whether the operator is one person.
Look for converging observations. Timing and device links strengthen a lead, without turning it into a confirmed identity.
03 / Offer termsPolicy & remedy+
The fictional terms allow one credit per person and permit a short review of suspected duplicate claims. The approved workflow pauses only the disputed credit, leaves normal paid access available and offers an appeal. Payment ownership evidence has not yet been checked.
The response should follow the actual offer terms and a documented review process. A promotion dispute need not become a full account ban.
Make the call.
Leave your reasoning.
Choose what you would do under this scenario’s assumptions. Your notes stay in this browser. Do not enter real customer information.
The trade-off
Still unknown
Are the twelve accounts operated by one person, and do they breach the actual eligibility terms? Shared devices do not answer either question on their own.
A useful handoff
Write down the exact eligibility rule, the evidence still needed, the review deadline and how a legitimate customer can appeal.
Completion records participation, not competence or certification. You can change your answer and compare again.
Further reading
OWASP / OAT-019 Account CreationReference checked 5 November 2026. The scenario, runbook and debrief are original Antifrog teaching material; the source does not endorse them.