Searching ACP For and Discouraging Specific IP Addresses

[Steve Freides]

I am dealing with a problem user who has registered for and uses our forum from one of two specific IP addresses and, when we stopped approving their posts, simply created another user account for themselves and attempted to post but from one of those same two IP addresses. Both addresses come from the same place.

1. I would like to: search for a specific IP address from the ACP for the purpose of finding out if I have any legitimate, still active users who belong to our forum, just for my own information. Is this possible and if so, how? A feature I've missed or requires an add-on and, if the latter, a link to one here would be appreciated.

2. I just added these two addresses to Discouraged IPs - my understanding is that this will prevent new registrations from those addresses but will not impact users who are already on our forum and using those addresses - is that right?

Any other thoughts on this would be appreciated.

As always, many thanks for all the help and guidance I receive here.

-S-

 

[Rene_V]

1. I would like to: search for a specific IP address from the ACP for the purpose of finding out if I have any legitimate, still active users who belong to our forum, just for my own information. Is this possible and if so, how? A feature I've missed or requires an add-on and, if the latter, a link to one here would be appreciated.

At the home page of the Admin panel there is a search field called: Search for users, where you can search for ip addresses.

2. I just added these two addresses to Discouraged IPs - my understanding is that this will prevent new registrations from those addresses but will not impact users who are already on our forum and using those addresses - is that right?

That's not correct. If you discourage an ip address, it will impact guests as well as registered users. At least that's my understanding on the subject.

I am dealing with a problem user who has registered for and uses our forum from one of two specific IP addresses and, when we stopped approving their posts, simply created another user account for themselves and attempted to post but from one of those same two IP addresses. Both addresses come from the same place.

I've coded an add-on that it will detect users who register multiple accounts and share the login using not only the same ip addresses, but devices too. It's very accurate if I say so myself. You can see it here should you be interested.

Resource icon R

Multiple accounts detector/Prevent multiple accounts registrations

Dec 11, 2025

Detects members who have registered multiple accounts&prevents multiple accounts registrations.

• Rene_V
• Add-ons [2.x]

 

[smallwheels]

1. I would like to: search for a specific IP address from the ACP for the purpose of finding out if I have any legitimate, still active users who belong to our forum, just for my own information. Is this possible and if so, how? A feature I've missed or requires an add-on and, if the latter, a link to one here would be appreciated.

/admin.php?users/search -> tab "search by IP-address"

2. I just added these two addresses to Discouraged IPs - my understanding is that this will prevent new registrations from those addresses but will not impact users who are already on our forum and using those addresses - is that right?

Not, that's incorrect. Discouraging an IP means that users coming from that IP will suffer from artificially created issues as if the had connection problems. Given you question and assumption it would probably be a good idea to read through the manual for XF to get familiar with the concepts and admin functions. Discouragement is i.e. described here:

Discouragement | XenForo

At times, banning a person may not be entirely effective. With the design of browsers, it's easy for a problematic user to register a new account.

docs.xenforo.com

I've coded an add-on that will detect multiple users who register and log using not only the same ip addresses, but devices too.

There is also an excellent one from XON with a pretty long proven track record. It does way more than to just detect multi accounts but needs a bit of knowledge and tinkering to use all possibilities:

X

Signup abuse detection and blocking

Nov 20, 2018

Provides a toolkit to reduce signup spam

• Xon
• Add-ons [2.x]

However, if said user comes from a fixed IP and no other users come from that IP I'd simply block the IP via ACP. While it is easy to circumvent that said user does not seem to bother that he can easily identified, so it might be enough.

 

[Steve Freides]

/admin.php?users/search -> tab "search by IP-address"

Duh - I guess because I never used that, it didn't even register with me that it existed.

Perfect - my two IP addresses have only been used by the two accounts from the same person that I'm trying to discourage.

I've coded an add-on that it will detect users who register multiple accounts and share the login using not only the same ip addresses, but devices too. It's very accurate if I say so myself. You can see it here should you be interested.

Thank you, will investigate.

Not, that's incorrect. Discouraging an IP means that users coming from that IP will suffer from artificially created issues as if the had connection problems. Given you question and assumption it would probably be a good idea to read through the manual for XF to get familiar with the concepts and admin functions. Discouragement is i.e. described here:

I am in a funny position - part-time employee, having been "administrator" of forum since the company switched to XF in 2015, an I'm even an ex-programmer, but at a certain level, things get taken care of by the actual admin. E.g., I cannot see the admin log although I can see the moderator log. But I created and manage our node structure and just about everything else.

But since the docs are online as indicated by the URL you gave, I could take a look at them - I literally never have.

-S-

 

[Rene_V]

I am in a funny position - part-time employee, having been "administrator" of forum since the company switched to XF in 2015, an I'm even an ex-programmer, but at a certain level, things get taken care of by the actual admin. E.g., I cannot see the admin log although I can see the moderator log. But I created and manage our node structure and just about everything else.

You can ask the admin if they can code an add-on that can extend the ip search functionality to the Moderator panel where all staff member can use it. It's a simple add-on to develop. I've done the same with my add-on that I linked in my previous post here. It lists the results on the Moderator panel too.

 

[smallwheels]

You can ask the admin if they can code an add-on that can extend the ip search functionality to the Moderator panel where all staff member can use it.

It is already there if you use this much recommended add on as part of it:

[Andrew] Moderator Panel

Nov 15, 2020

A suite of enhanced options and visibility all built into a single moderator panel

• AndrewSimm
• admin mod moderating moderator user notes
• Add-ons [2.x]

Not sure that all staff member have / should have the permission for IP-search.

 

[Steve Freides]

Today I noticed three different new members attempting to join from the same IP address within the last 24 hours. I checked that IP address via Search and had no others, so I Discouraged that IP. For the moment, this seems an acceptable solution.

I'd appreciate comments as to the difference between Discourage and Ban - I know what both do but in this case, i could also see using Ban and just knowing I'll never have to worry about this.

FWIW, the spam cleaner we use is very helpful but once in a while, someone uses the Contact button on our site and writes to say they want to join and can't understand why they were banned, and in all of those cases so far, they seem to be legit new users who just happened to have gotten handed an IP used by a spammer in the past or something along those lines, and therefore I generally allow those people to join.

Not sure if there's a "best practice" to be had here ...

-S-

 

[smallwheels]

Not sure if there's a "best practice" to be had here ...

Simple: Never ban an IP from a pool of dynamic IPs that may be used by legitimate, wanted users.
Only ban IPs of either fixed IP-lines or data centers where you are sure that nothing but bad traffic comes from there (or at least nothing of interest). Ban dynamic IP-Ranges (or for that matter ASNs or countries) from regions where you have no audience, don't want to have audience from, where your users don't travel to and where you suffer bad traffic like spammers, scrapers or resident proxies.

The simple rule is: A dynamic IP is not suitable, reliable or helpful to identify a certain person/user for longer than a day at most in most cases. You may ban it but then you should lift the ban after a day or so.

If you want to stop signup spam there are better tools: the "spaminator" series by @Ozzy for automated signups by bots and the signup and abuse detection add on by @Xon against everything else which also helps against multiaccounts. It is however not a turnkey solution and needs a bit of work, learning, adaption and time to make best use of it.

 

[Xon]

The discourage feature can also knock your site offline if you have the "Loading delay" functionality turned on. Do not use that feature!