Administrative and Maintenance Tools - Duplicate IP Report by BOP5 (Checks for users sharing the same IP Addresses) VB3/VB4

Brought to you by BirdOPrey5
www.Qapla.com

Version 2.1.2 - Fixed MySQLi bug - Introduced GOLD/Premium Version
Version 2.1 - Added BBCode to Banned Users and Post Count Options, better debug info
Version 2.0 - Added report for Registration (User) IP Address Checking

Check out the GOLD Version for these additional features:

• Run reports directly from the Admin CP anytime you want
• Post daily report as a "New Post" into an existing thread rather than a "New Thread" each night
• Access to another Gold Mod- Recent Registration Check- will block spammers and scammers trying to register multiple accounts from the same IP address

This mod will run a nightly scan of your "post" and/or "user" table. It will report if it finds any users sharing the same IP address. You choose in the options how many days back you want to look. (Max of 5000 days, but please use more reasonable limits.)

If any "duplicate use" is found the IP addresses, usernames and optionally the posts themselves will be reported.

See a real report: Report Demo at Qapla.com

The report takes the form of a new thread posted to the forum of the Admin's choosing (A private forum for mods or admins is strongly recommended.)

There are options for whitelisting (ignoring) specific IP Addresses and/or userids so if you or your mods post as other users you can prevent that from being reported. If you use the Zoints Anonymous Posting mod you will want to put that userid on the whitelist else the report will out whoever posted "Anonymously."

NOTE: There are PERFECTLY valid reasons 2 or more users may share the same IP address. This report in and of itself is not proof of malicious activity. Users that connect by mobile devices, work in same offices, or go to the same schools for example would likely share the same IP address on some posts. So would too any users connecting from the same home or public Wi-Fi network.

As of version 2.0 there is a report for both the "post" and "user" table. The "user" table will find when 2 or more users register with the same IP address.

Tested and working on VB 3.8.7 and VB 4.1.12/4.2.0 and should work on all 3.7 / 3.8 / 4.x versions.

------------------------------------------------------

Please "Mark as Installed" if you use this.
Donations always appreciated. :up:
Nominate MOTM if you LOVE it!

[BirdOPrey5]

Originally Posted by djbaxter

Thanks BOP5.

I see the only problem is that it says that "Invalid days" line, everything actually runs as expected. You're not getting a report because you have "Post empty reports" set to "No." If you set it to yes the report would run (but be empty.)

I have made the fix in my working copy but since it doesn't effect performance I'm not going to update the mod just for this minor change- it will be part of the next release. :up:

[Skyrider]

Is there anyway that people who have been banned can be mentioned? This way, I can easily check if someone has been banned already and a duplicate user by-passed the ban (not yet banned) with another account.

And or an option that banned people can be excluded of being posted on the duplicate IP list?

And perhaps an option to show how many posts each account has within the reported thread.

[BirdOPrey5]

As of now banned users should be showing up on the list.

Adding an option to exclude banned users sounds like a good idea, as do post counts- both should be fairly easy and I will try to get it into the next version.

[Skyrider]

As of now banned users should be showing up on the list.

Indeed it does , but it also shows up non-banned users. So I have to manually see which one has been banned and which one hasn't been banned. Maybe defined by a color (green = non-banned, red = banned) to easily see the difference.

Adding an option to exclude banned users sounds like a good idea, as do post counts- both should be fairly easy and I will try to get it into the next version.

Thanks , appreciate it.

[charlesr]

Thanks. Installed

[djbaxter]

Typo in bop5_dupeip.php:

Line 229:

Change:

PHP Code:

$report .= "[B]Duplicate Resgistrations IP Report for $today, looking back $unumdays days.[/B] \r\n\r\n"; 


To:

PHP Code:

$report .= "[B]Duplicate Registrations IP Report for $today, looking back $unumdays days.[/B] \r\n\r\n"; 


[BirdOPrey5]

thanx.

[BadgerDog]

Intalled for testing with thanks ...

Is there a reason that moderators show up with duplicate IP's as some standard registered users?

Perhaps has something to do with them moderating (editing or deleting) the registered user's post, causing the moderator's IP to be added?

Regards,
Doug

[BadgerDog]

Follow up ...

A great idea for a mod and in my opinion, badly needed, however, it has one caveat that everyone should be aware of, already pointed out by bop5 ...

NOTE: There are PERFECTLY valid reasons 2 or more users may share the same IP address. This report in and of itself is not proof of malicious activity. Users that connect by mobile devices, work in same offices, or go to the same schools for example would likely share the same IP address on some posts. So would too any users connecting from the same home or public Wi-Fi network.

According to the output from this mod, I have a single IP address 132.3.33.68 being shared as a registration IP by 7 different users. It's absolutely correct, except the IP address is from a military base where IP addresses are rotated and assigned randomly (and re-used). All 7 members are legitimate and not spammers etc,. so one has to be careful as to how to use the information provided.

It's very common for dial-up and internal networks to re-use and re-assign outbound IP addresses, so unless there's a way of ensuring that the multiple registrations (or posts) come from a specific machine, it's a bit of leap to assume too much. I also use the "cookie" based program which does run for me under 4.1.3pl5 and yes, cookies can be deleted, but I find it's been 90% plus in nailing spammers and other dysfunctional folks who have tried to register 0r re-register under different names.

I don't know if this mod could be enhanced to add "cookies" or some other method to furthe narrow the data, so good guys aren't inadvertently nailed along with bad guys ....

Nice work BOP5 .. appreciate your efforts ...

Regards,
Doug

[BirdOPrey5]

Originally Posted by BadgerDog

Intalled for testing with thanks ...

Is there a reason that moderators show up with duplicate IP's as some standard registered users?

Perhaps has something to do with them moderating (editing or deleting) the registered user's post, causing the moderator's IP to be added?

Regards,
Doug

Doug,

In my test a moderator editing a post did not change the original IP Address assigned to the post. I checked on VB 4.1.12.