[HeadStAtE!]

This code can also be used (with slight modifications) to flag attempted unauthorised use of moderation features in moderator.php.

Find each occurance of:

PHP Code:

show_nopermission(); 


Before this line of code add:

PHP Code:

$ipaddress=iif(getenv("REMOTE_ADDR")!="",getenv("REMOTE_ADDR"),$HTTP_HOST);
$iphostname = @gethostbyaddr($ipaddress);
$message="Someone is trying to access the moderator user options.\n\nUsername is using: $loginusername\nPassword he tried to use: $loginpassword (".md5($loginpassword)." in encryption)\n\nThe IP address is: $ipaddress\nThe host is: $iphostname";
    mail($webmasteremail,"Warning: vBulletin access to the moderator functions tried.",$message,"From: \"$bbtitle \" <$webmasteremail>"); 


I've found a few users trying the mod screen via the admin link that is displayed to all users in the template getinfo.

Users accessing the moderator.php options can also be viewed in the Currently Active Users list with the description "Unknown Location:/moderator.php"