Private forum - but Guests are viewing thread

[jilljab]

Thank you in advance - this really has me stumped. I'm working on a private forum http://www.treasurehunterscove.com and it is for paid members only. I have the permissions set to cannot view forum except for Admins and Paid Members (usergroup). But I keep seeing in the Who's Online guests from a specific range of ip addresses online (I normally see 2 or 3 with just different numbers at the end) saying "Guest" viewing thread. It does say they are getting the no permissions message. But they are constantly on here.

I tried monitoring this by logging in as me in Firefox and then not logging in on IE and watching what it says each time I click on something new in IE - but I can't get it to replicate the "viewing thread" message.

What am I doing wrong? Are they really viewing a thread? If not, why are they constantly showing up?

Thank you in advance! I just can't figure it out!
Jill

--------------- Added 1323226855 at 1323226855 ---------------

Now one is saying "Managing Attachments"!!!!

[Lynne]

If they are getting the No Permission sign, then they are not seeing it. My guess would be these are just spiders that are showing as trying to view these threads.

[jilljab]

Later last night, I saw this same guest was on and it says they were sending a private message to one of our users. How would they even know this user's name? It's not one I could ever guess. I messaged her to see what the message was and haven't gotten an answer back yet.

Is there a way to see someone else's private messages as an administrator? I'm wondering if maybe this IS a registered user and maybe originating from a cell phone? (I know my iphone doesn't always show as being logged on if I'm also logged on on my pc)

Thanks!!!

[Max Taxable]

Do you view the User Agents in online.php? This can be very informative.

Most all bots visit links randomly and automatically, their information comes from a database. When they appear to be sending a private message, it merely means one of the links in their database was correct. They don't know the name of the user or need to know it, and they don't find it out by visiting the link either. Example:

http://www.treasurehunterscove.com/private.php?do=newpm&u=2

Following this link will take me to the "no permission" page, but to you in online.php it will look like I am sending user #2 a private message. But clearly I am not because I would have to be logged in to do so.

Mobile devices DO show up in online.php. Even your own, when you are logged in via PC. Problem is, when you yourself refresh online.php, the system defaults to that visit and "hides" your mobile browser's hit. Therefore you're only hiding yourself, regular users cannot do so.

A good modification for tracking guest visits and logging spiders is here:

https://vborg.vbsupport.ru/showthread.php?t=201214

There's also a couple of good mods for blocking spiders and bots by user agent.

[jilljab]

Thank you SO much!!! I feel so much better now!!