XF 1.3 Find out where user logged in from

[gdscei]

After a security breach, I am trying to find out from which IP a user logged in from. Is there a log for that? Where is it stored? I had a look at the database, but couldn't exactly find what I was looking for.

Sorry if this is the wrong board btw, I wasn't 100% certain which one I should post this in.

 

[Paul B]

The member profile page in the ACP lists all recently used IP addresses.

 

[gdscei]

The member profile page in the ACP lists all recently used IP addresses.

Hi,

Thank you for the information. Do you know where this is located in the database? I do not have the forums running atm after this security breach.

 

[Paul B]

xf_ip

 

[gdscei]

Thank you, I found out the IP. Another question, is there a way to differentiate between a user actually logging in or logging in as a user from admin panel?

 

[Paul B]

Check the action column in that table.
It is 'login' or 'login_admin'.

 

[gdscei]

Aha, I see! Can I also find out which admin account that was if it is login_admin?

 

[Paul B]

It's the user_id field.

 

[gdscei]

Ah yes. Thank you very much for your quick responses!