Administrative and Maintenance Tools - Duplicate IP Report by BOP5 (Checks for users sharing the same IP Addresses) VB3/VB4

Brought to you by BirdOPrey5
www.Qapla.com

Version 2.1.2 - Fixed MySQLi bug - Introduced GOLD/Premium Version
Version 2.1 - Added BBCode to Banned Users and Post Count Options, better debug info
Version 2.0 - Added report for Registration (User) IP Address Checking

Check out the GOLD Version for these additional features:

• Run reports directly from the Admin CP anytime you want
• Post daily report as a "New Post" into an existing thread rather than a "New Thread" each night
• Access to another Gold Mod- Recent Registration Check- will block spammers and scammers trying to register multiple accounts from the same IP address

This mod will run a nightly scan of your "post" and/or "user" table. It will report if it finds any users sharing the same IP address. You choose in the options how many days back you want to look. (Max of 5000 days, but please use more reasonable limits.)

If any "duplicate use" is found the IP addresses, usernames and optionally the posts themselves will be reported.

See a real report: Report Demo at Qapla.com

The report takes the form of a new thread posted to the forum of the Admin's choosing (A private forum for mods or admins is strongly recommended.)

There are options for whitelisting (ignoring) specific IP Addresses and/or userids so if you or your mods post as other users you can prevent that from being reported. If you use the Zoints Anonymous Posting mod you will want to put that userid on the whitelist else the report will out whoever posted "Anonymously."

NOTE: There are PERFECTLY valid reasons 2 or more users may share the same IP address. This report in and of itself is not proof of malicious activity. Users that connect by mobile devices, work in same offices, or go to the same schools for example would likely share the same IP address on some posts. So would too any users connecting from the same home or public Wi-Fi network.

As of version 2.0 there is a report for both the "post" and "user" table. The "user" table will find when 2 or more users register with the same IP address.

Tested and working on VB 3.8.7 and VB 4.1.12/4.2.0 and should work on all 3.7 / 3.8 / 4.x versions.

------------------------------------------------------

Please "Mark as Installed" if you use this.
Donations always appreciated. :up:
Nominate MOTM if you LOVE it!

[Nirjonadda]

Press this button to manually run the report not working:
Internal Server Error
The server encountered an internal error or misconfiguration and was unable to complete your request.

[djbaxter]

Originally Posted by BirdOPrey5

How many "Days back" did you set for the report to run for both posts and users?

It should be a value between 0 and 5000 for both of those or else you get that error.

I left them at the defaults:

How Many Days Back To Check? (Posts) = 7
Enter the number of days of previous posts to search for this report. Set to 0 to disable this report.

How Many Days Back To Check? (Users) = 30
Enter the number of days of previous registrations to search for this report. Set to 0 to disable this report.

Records Limit = 500
This is the absolute max number of IP Addresses that will be returned in any report. Even on large forums this usually would not be a very large number, this limit is like a safety check- if your reports return anywhere near this limit there are probably bigger issues.

Note that this was a manual run. The full output says this:

Duplicate IP Report by BOP5


Dupicate IP Check Start
Post Report - Valid numdays: 7
User Report - Valid numdays: 30
No Duplicates Found - No Report Created
Invalid Day Back - Report Not Run.

Go Back

Done

[Razta]

Thank you very much, works great with vBulletin 4.1.12 Patch Level 1

[BirdOPrey5]

Originally Posted by Nirjonadda

Press this button to manually run the report not working:
Internal Server Error
The server encountered an internal error or misconfiguration and was unable to complete your request.

What values are you setting for days back? Try setting them low- really low, like 1 and 1, and see if it works. It will give me an idea of the issue.

Originally Posted by djbaxter

I left them at the defaults:

How Many Days Back To Check? (Posts) = 7
Enter the number of days of previous posts to search for this report. Set to 0 to disable this report.

How Many Days Back To Check? (Users) = 30
Enter the number of days of previous registrations to search for this report. Set to 0 to disable this report.

Records Limit = 500
This is the absolute max number of IP Addresses that will be returned in any report. Even on large forums this usually would not be a very large number, this limit is like a safety check- if your reports return anywhere near this limit there are probably bigger issues.

Note that this was a manual run. The full output says this:

Are you familiar with running manual SQL queries if I gave you a couple to run?

Originally Posted by Razta

Thank you very much, works great with vBulletin 4.1.12 Patch Level 1

Please "Mark It as Installed" :up:

[djbaxter]

Originally Posted by BirdOPrey5

Are you familiar with running manual SQL queries if I gave you a couple to run?

Yes. Fire away.

[BirdOPrey5]

#1)

SELECT ipaddress, GROUP_CONCAT(DISTINCT userid) AS userid, GROUP_CONCAT(DISTINCT postid) AS postid
          FROM post
          WHERE dateline > 1335925435 AND userid > 0 AND ipaddress != '' 
          GROUP BY ipaddress
          HAVING COUNT(DISTINCT userid) > 1
          ORDER BY COUNT(DISTINCT userid) DESC
          LIMIT 500;

That is the code for the 7 day look back of the posts table. You will have to put a table prefix in front of "post" if you use them.

#2)

SELECT ipaddress, GROUP_CONCAT(DISTINCT userid) AS userid
          FROM user
          WHERE joindate > 1333938235 AND userid > 0 AND ipaddress != '' 
          GROUP BY ipaddress
          HAVING COUNT(DISTINCT userid) > 1
          ORDER BY COUNT(DISTINCT userid) DESC
          LIMIT 500;

That's the 30 day look back of the User table.

I'm curious if either of these produce any results (return any rows.)?

If they don't, let me know. if they do maybe you can PM me what it returns, you can edit/mess up the IP addresses for privacy if need be.

[djbaxter]

SELECT ipaddress, GROUP_CONCAT(DISTINCT userid) AS userid, GROUP_CONCAT(DISTINCT postid) AS postid
FROM post
WHERE dateline > 1335925435 AND userid > 0 AND ipaddress != ''
GROUP BY ipaddress
HAVING COUNT(DISTINCT userid) > 1
ORDER BY COUNT(DISTINCT userid) DESC
LIMIT 500;

Result: MySQL returned an empty result set (i.e. zero rows). ( Query took 0.0026 sec )

SELECT ipaddress, GROUP_CONCAT(DISTINCT userid) AS userid
FROM user
WHERE joindate > 1333938235 AND userid > 0 AND ipaddress != ''
GROUP BY ipaddress
HAVING COUNT(DISTINCT userid) > 1
ORDER BY COUNT(DISTINCT userid) DESC
LIMIT 500;

Result: MySQL returned an empty result set (i.e. zero rows). ( Query took 0.0030 sec )

[BirdOPrey5]

OK. Well the good news is you don't have any duplicates in your forum.

The bad news is... I have to fix my code to deal with that situation- it was the one situation I couldn't test because I was always seeing duplicates in one or the other.

I'll probably release a fix later today. I'm confident that if you did have a duplicate the report would run as expected.

[djbaxter]

Thanks BOP5.

[RisingGlow]

Awesome mod! Something that I've been looking for. Many IP/multiple accounts reporting mods really only check on registering, and not posts, which is just as vital.