XF 1.1 Glitch or...?

[lazer]

Hi guys

We recently banned a member and it showed up in spam cleaner and the ACP that he had the same IP addresses (in a whole list of other IPs) as other members.

I know the geographical location of some of these members and they are not the same as the banned member.

Is this merely a glitch or the sign of something more sinister?

Cheers.

 

[Chris D]

Do you use Cloud Flare or some other similar type of caching or CDN?

 

[lazer]

No, not Cloudflare or anything like that...

As for caching, we do use APC.

 

[Paul B]

What does the IP address resolve to?
Is it a proxy or shared network device?

 

[lazer]

The IP addresses are domestic ISP's, not proxies or shared networks.

Basically, in the two instances of this (see bottom image), other members - including the banned member - are listed as using the same IP address as another member.

Here's an example...

Member 1 - Domestic ISP (US) - the IP "belongs" to this member. I know his exact location and the IP checks out to his ISP and geo location.
"Banned" Member 2
Member 3 - Domestic ISP (Netherlands)



Example 2:



..again, the IP "belongs" to the second member in the list.
The above info is from the following days and times. There are no other clashing IP's in this banned members IP list.

 

[lazer]

Actually, I've just checked and this happens on other accounts...

For instance, my IP address is listed in the user IP list, for another user who I absolutely know for a fact is trustworthy and lives in a different country to me.

 

[Mike]

It's possible that the wrong IP was recorded against a user. This isn't something we've had any other reports of, so it could be add-on related.

 

[lazer]

It's possible that the wrong IP was recorded against a user.

Yep, that's definitely what it's looking like Mike. In fact, the issue seems to have existed prior to our conversion to xF (so long as historic IP records are transferred during the conversion). That would discount the "add-on" idea...

It doesn't happen a lot, and the correct IP's are being recorded for users..odd huh?

 

[ARealRiley]

Did you convert from vB and use the AE detector plugin?

 

[lazer]

I converted from VB. What's the AE Detector?

 

[ARealRiley]

A multiple account detector. Whenever I used it, it liked to add my ip to detected multiple accounts. That's probably where they came from.

 

[lazer]

Good call Freddie. Yes, we do use one of those with xF and we also used one with vB.

 

[Carlos]

Another thing to consider; I think this is a result of "account buying" between folks.

I see this too often in checking spammer accounts. One person owns the account, the next person buys the account from user, then the result is that the person whose account seems from one IP, to the other.... In fact, if you check the other accounts in the list you provided, you'll see two different IP's and/or including the one that's showing in the same pane as the pictures.

 

[Sheldon]

Do you happen to have one of ragtek's old add-ons installed?

--Nevermind, I think a couple of posts above you may have your answer.

I do recall the NUNS ragtek made used to always add the admin's IP address to all those that registered.