IP address online multiple times
 

I run a small forum with some 700 members and just recently I noticed my users online count was up from an average of 20 to 40 or 50.

The users are all from Japan -

119.63.196.89
119.63.196.52
119.63.196.87
119.63.196.89
119.63.196.77
119.63.196.175
119.63.196.120
119.63.196.110

etc etc approx 20 similar addresses

They've been there for days, never signing out.

I 'banned' them

as in 119.63.196.*
119.63.196.45

where is says --

Use this option to prevent certain IP addresses from accessing any part of your board.

If you enter a complete IP address (242.21.11.7), only that IP will be banned.
If you enter a partial IP (243.21.11. or 243.21.11), any IPs that begin with the partial IP will be banned. For example, banning 243.21.11 will prevent 243.21.11.7 from accessing your board. However, 243.21.115.7 would still be able to access your board.

You may also use an '*' as a wildcard for increased flexibility. For example, if you enter 243.21.11*, many IPs will be banned including: 243.21.11.7, 243.21.115.7, 243.21.119.225.

Place a space or a line break between each IP address.


but that doesn't seem to work as they are all still there.

I don't understand what they are up to, but it can't be 'above board', can it?

Hi kazzer,

what do you mean by banned? Did you just ban their accounts or did you delete them? In waht way are they back? Are they still showing as being online, or did they re-register at the forum?

While IP blacklisting is a good feature, I wouldn't necessarily do it in VBulletin itself. If you do have a root server, block these IP addresses in your system's firewall (IPTABLES). This way packets from banned IP addresses never make it up all the way of your network stack, and they won't be delivered to the VBulletin application, that would discard them at this point in time.

If you have IPTABLES, enter this
iptables -A INPUT -s xxx.xxx.xxx.xxx/yy -j DROP
where xxx is the IP address and yy is the subnet mask in CIDR notation.

I went to -
admin>options>user banning options then listed the IP address as 119.63.196.*

As I understood it, that would prevent them access to the board.

These guys are there , all day and night, never sign out. Why?

I would just use Cpanel to deny the entire 119.63.196. range since I run a local forum. In fact, I already have most of Africa, Russia, and the far east blocked.

You'll need to do a Whois lookup online to see what ISP that is and get the entire range of IP numbers assigned to them.

Same here. I want to know why as well.