Just in case it's useful, here is the query I run to identify all IP addresses used by a specific user or group of users:
SELECT ip.user_id,
user.username,
ip.content_type,
ip.content_id,
ip.action,
INET6_NTOA(ip.ip) AS ip_text,
ip.log_date,
CONVERT_TZ(FROM_UNIXTIME(log_date)...