[Kiros72]

Alright. I have just reread your post and I'm actually wondering exactly what you meant. Did you mean that there was a detection of matching IP addresses, but the IP addresses didn't actually match? If so, prep and run this SQL:

SELECT  userid
FROM %table_prefix%user
WHERE ipaddress = '%problem_ip%'

Be sure to replace the %table_prefix% with the table prefix (like 'vb_' or 'vbulletin_' or something else) that your database uses for vBulletin. Replace %problem_ip% with the IP address that was reported as the matching IP address.

After you run it, you should get 2 results if it's actually working properly.

If you meant that you wanted it to catch the incident, but it didn't, then there's not much that I can do for that. The entire IP address of everyone is checked because there can be hundreds of people that have a matching first three numbers (i.e. 124.78.20.100 could be the same person as 124.78.20.201, but it could also be someone else entirely). Checking only the first three numbers would make for a lot of false positives over the years.