what should i do?
 

I was looking at the who's online list and there was this one guest. It said that they were moderating. What should i do? I banned the IP address.

Visiting the page doesn't mean it is able to actually do anything. So what we see in WoL isn't always what's actually going on.

For example i could go to your site and manually type in /inlinemod.php but if i am not logged in and/or don't have the necessary permissions, you'll still see me as "moderating" in WoL anyway.

I recommend you check that IP address to see if it is a legitimate hostname - one that normal people use - before banning. You could well be blocking legitimate people especially if it is a mobile service.

Yes there is nothing to worry about. You should have see the https://vborg.vbsupport.ru/external/2015/01/45.png Viewing Error Message next to the Location, so you know they were not actually doing anything.

Also what could of happen is one of your moderators clicking on a saved bookmark and going to a page where they moderate something ... I banned a moderator once for this very thing lol ...

What you can do is do an IP search from the admin panel to see if it belongs to one of your members first ...

i did a search on StopForumSpam and the IP was listed as a spammer.

i did see the viewing error message symbol next to it.

When I first was promoted to admin at the site with which I help, I was startled to see a guest administrating the site...but I was assured by the site owner this is fairly normal to see, and he cited the same issues given in this thread. It is understandable that you found this disconcerting. :D

I would just ignore the issue, unless the same IP is always trying.

I just checked it and the IP was trying to, even though i banned it.

You may have to wait for your online page to update, it will take as much time as you have set in Session Timeout for it to not show anymore.

the hostname was this "rate-limited proxy". There are now a lot of these "rate limited proxy" IPs on my site right now trying to access areas they should not be accessing like the modcp and the admincp. The other admin got an email saying he had been locked out of his account because the failed password attempts. Is someone trying to hack/brute force my site?