Administrative and Maintenance Tools - Duplicate IP Report by BOP5 (Checks for users sharing the same IP Addresses) VB3/VB4

Brought to you by BirdOPrey5
www.Qapla.com

Version 2.1.2 - Fixed MySQLi bug - Introduced GOLD/Premium Version
Version 2.1 - Added BBCode to Banned Users and Post Count Options, better debug info
Version 2.0 - Added report for Registration (User) IP Address Checking

Check out the GOLD Version for these additional features:

• Run reports directly from the Admin CP anytime you want
• Post daily report as a "New Post" into an existing thread rather than a "New Thread" each night
• Access to another Gold Mod- Recent Registration Check- will block spammers and scammers trying to register multiple accounts from the same IP address

This mod will run a nightly scan of your "post" and/or "user" table. It will report if it finds any users sharing the same IP address. You choose in the options how many days back you want to look. (Max of 5000 days, but please use more reasonable limits.)

If any "duplicate use" is found the IP addresses, usernames and optionally the posts themselves will be reported.

See a real report: Report Demo at Qapla.com

The report takes the form of a new thread posted to the forum of the Admin's choosing (A private forum for mods or admins is strongly recommended.)

There are options for whitelisting (ignoring) specific IP Addresses and/or userids so if you or your mods post as other users you can prevent that from being reported. If you use the Zoints Anonymous Posting mod you will want to put that userid on the whitelist else the report will out whoever posted "Anonymously."

NOTE: There are PERFECTLY valid reasons 2 or more users may share the same IP address. This report in and of itself is not proof of malicious activity. Users that connect by mobile devices, work in same offices, or go to the same schools for example would likely share the same IP address on some posts. So would too any users connecting from the same home or public Wi-Fi network.

As of version 2.0 there is a report for both the "post" and "user" table. The "user" table will find when 2 or more users register with the same IP address.

Tested and working on VB 3.8.7 and VB 4.1.12/4.2.0 and should work on all 3.7 / 3.8 / 4.x versions.

------------------------------------------------------

Please "Mark as Installed" if you use this.
Donations always appreciated. :up:
Nominate MOTM if you LOVE it!

[thunderclap82]

Originally Posted by BirdOPrey5

There is a "Day of Week" option drop-down in the Scheduled Task editor.

Doh! Missed that one right in front of me. Thanks!

[spankaveli]

I see a way to whitelist certain IPs but is there a way to whitelist IP blocks? (for example, the 166.x.x.x block since that is used by AT&T wireless?)

[BirdOPrey5]

Originally Posted by spankaveli

I see a way to whitelist certain IPs but is there a way to whitelist IP blocks? (for example, the 166.x.x.x block since that is used by AT&T wireless?)

No, not at this time... Will look into adding that into a future version.

[iraqiboy90]

Originally Posted by BirdOPrey5

An email option is a good suggestion I will try to add in a future version. The debate whether a post or email is better is just going to be personal preference. I like keeping records as posts since I have a forum for all sorts of automated reports- but I can certainly understand the desire to have it by email instead.



In this respect the Gold and Free versions work the same.

Yes and no... The same posts will be re-reported if they are within the look back window of both reports, but each day that goes by the oldest duplicates will fall off the report. So if your post look back window is 7 days on the day 1 report you will see all duplicates in the last 7 days. But by day 4 you'll see only 3 days of duplicates as by your example there have been no duplicates for 4 days at that point.

Honestly... If you have all that many duplicates there's a problem... If your site is small then people are definitely using "Alter egos" - If you have a very busy site your look-back window would be a lot shorter, just because there are too many posts to query at once. So on a super busy forum I would image a look back window of only say 3 days instead of 7 or 30. A 3 day window means about 33% of the reports are new each night.

For example on my OT forum which has about 100 active members on any given day and maybe 300 unique members in a month, I do a post look-back of 7 days. After cleaning up all the initial multiple-accounts found by this mod, sometimes weeks go by with no duplicates reported- what is is just the occasional mobile users who wind up on the same IP.



Whitelisting specific IPs or usernames are an option but no way to not show duplicates previously reported if they fall in the same look-back window.

I suppose you can edit the scheduled task to run once a week instead of every night, then set a look-back window of 7 days, so each time it runs it is completely fresh data that will only be reported once, but in that case you could go an entire week before being notified about a duplicate account.

Problem is that at one time my forum was reporting the wrong IP of the users. It was instead reporting an internal IP, the same one for everyone, for almost 6-9 hours.

In this time, there has been created multiple posts, which is why my report is long and got to many post numbers in it.

Manually editing the IP (by removing them) from the DB (manually, I guess) will be lot of pain. Therefore I see that whitelisting that IP will be a better option, if there is no other option you can recommend.

regards

[cshellworld]

4.2.1 installed , thanks

[Barcham]

This is exactly what I've been needing. I am in the process of setting up a new board and I am certain that I am going to have some problems with some members of a former board I used to belong to. this will be a great help in tracking them down before they can cause problems!!!

Thank you so much!!!

[MarkFL]

Ever since I was promoted to global moderator at the site I now help administrate, I have been wanting something like this. Now I don't have to go on hunches and suspicions alone...this was easy to install and is easy to use (vBulletin 4.2.0 patch levels 3 & 4 and 4.2.1).

Great work, BOP5! :up:

5 star rating and nominated for MOTM.

[mservis]

Perfect.
installed in vBulletin 4.2.2 Patch Level 1

Working now

Greetings

[Skyrider]

This might be a bug (or missing feature) but.. Right now it looks like in ACP... posts IPs are getting compared with all IPs (post and registration ones) ... while registration IPs are getting compared ONLY with other registration IPs.

For example at our "Boo" user and another profile using same IP.

That's what it looks like given that when looking at Boo, you can find the other acount via the post IP, even tho the other account used that IP as registration

Is this an issue?

[BirdOPrey5]

Originally Posted by Skyrider

This might be a bug (or missing feature) but.. Right now it looks like in ACP... posts IPs are getting compared with all IPs (post and registration ones) ... while registration IPs are getting compared ONLY with other registration IPs.

For example at our "Boo" user and another profile using same IP.



Is this an issue?

I'm may not be fully understanding the question- but looking at the SQL query it is clear the only IP addresses being checked in the posts report are the post IP addresses. It would be impossible for that query to check against registration IPs as those IPs are never returned/mentioned in the query.

If "Boo" is being returned in the post report it means the other username returned with boo has also posted posts with the same IP boo has posted from during the report period.