Administrative and Maintenance Tools - Duplicate IP Report by BOP5 (Checks for users sharing the same IP Addresses) VB3/VB4

Brought to you by BirdOPrey5
www.Qapla.com

Version 2.1.2 - Fixed MySQLi bug - Introduced GOLD/Premium Version
Version 2.1 - Added BBCode to Banned Users and Post Count Options, better debug info
Version 2.0 - Added report for Registration (User) IP Address Checking

Check out the GOLD Version for these additional features:

• Run reports directly from the Admin CP anytime you want
• Post daily report as a "New Post" into an existing thread rather than a "New Thread" each night
• Access to another Gold Mod- Recent Registration Check- will block spammers and scammers trying to register multiple accounts from the same IP address

This mod will run a nightly scan of your "post" and/or "user" table. It will report if it finds any users sharing the same IP address. You choose in the options how many days back you want to look. (Max of 5000 days, but please use more reasonable limits.)

If any "duplicate use" is found the IP addresses, usernames and optionally the posts themselves will be reported.

See a real report: Report Demo at Qapla.com

The report takes the form of a new thread posted to the forum of the Admin's choosing (A private forum for mods or admins is strongly recommended.)

There are options for whitelisting (ignoring) specific IP Addresses and/or userids so if you or your mods post as other users you can prevent that from being reported. If you use the Zoints Anonymous Posting mod you will want to put that userid on the whitelist else the report will out whoever posted "Anonymously."

NOTE: There are PERFECTLY valid reasons 2 or more users may share the same IP address. This report in and of itself is not proof of malicious activity. Users that connect by mobile devices, work in same offices, or go to the same schools for example would likely share the same IP address on some posts. So would too any users connecting from the same home or public Wi-Fi network.

As of version 2.0 there is a report for both the "post" and "user" table. The "user" table will find when 2 or more users register with the same IP address.

Tested and working on VB 3.8.7 and VB 4.1.12/4.2.0 and should work on all 3.7 / 3.8 / 4.x versions.

------------------------------------------------------

Please "Mark as Installed" if you use this.
Donations always appreciated. :up:
Nominate MOTM if you LOVE it!

[Skyrider]

Originally Posted by BirdOPrey5

I'm may not be fully understanding the question- but looking at the SQL query it is clear the only IP addresses being checked in the posts report are the post IP addresses. It would be impossible for that query to check against registration IPs as those IPs are never returned/mentioned in the query.

If "Boo" is being returned in the post report it means the other username returned with boo has also posted posts with the same IP boo has posted from during the report period.

I'll give an example.

We currently found 2 forum profiles, of which we are sure that they are the same person, but the duplicate IP report isn't showing it in the report.

I'll replace Boo with Person A and the other profile with Person B.

Person A has a post count of 0, and the registration IP address in the AdminCP (of the profile) is 123.456.789 (not showing real IP address for obvious reasons). When I check his IP address through the AdminCP, it shows:

Registration IP Address - 123.456.789
Post IP Addresses - No Matches Found
Registration IP Addresses - No Matches Found

Awesome, lets continue!

Now, when I look at Person B

Has 3 post counts, and the registration IP address in the AdminCP is 987.654.321

Now, you can see that Person A and Person B don't have a matching IP address. However, when I use the AdminCP to View the IP address of Person B.

Registration IP Address - 987.654.321
Post IP Addresses - 123.456.789 [Find More Users with this IP Address]

Clicking "[Find More Users with this IP Address]" results in:

123.456.789 [host information here]

Post IP address:
Person B 123.456.789

Registration IP address:
Person A 123.456.789

As you can see. Person B with 3 posts, at least used the Post IP address of person A once. I can't find any IP reports from user A, but when I search through the IP results of Person B, I can find Person A.

I was wondering if this plugin can be extended a little bit so it can include the registration/post IP address match, regardless if it cannot be found in 1 profile, but can be found through another.

Hope you understand it a bit now.

(in this example I might have switched the IP's, 123 with 987 at the end. If that's the case, just swap them). Was using 2 example IP addresses and it is possible I mixed them up with one and other. But I think you'll get the general idea.

[BirdOPrey5]

Oh, I did misunderstand. I thought you were reporting a bug because registration IPs were not only being checked against registration IPs...

Indeed it was by design registration IPs only check against other registration IPs and post IPs only check against other post IPs.

You want a report that checks across both...

Unfortunately that was not an intended option and it is not something I will be adding- it would be a more difficult query and honestly one I think would be of limited use- as is these queries can take a big hit on the server- making them more complex will increase the chance of timeout/db errors.

Sorry.

If I had an idea I'd give you a hint on how to make the change yourself- the query code is in the php file- but I'm not sure how to go about combining the two- as is these were about as complex a mysql query I can handle.

[Amenadiel]

+1 for supporting wildcards and or IP blocks in the IP whitelist field. I want to add Cloudflare's IP ranges.

[Kesha]

Hey BOP!

I just installed your mod and I'm currently attempting to run it from the Admin CP (Options section) to try it out. I have a private forum set up, which is only accessible by Moderators and Admins. The issue is, when I click the Run Now button, the resulting page is simply "Duplicate IP Report by BOP5" followed by the word "Done" on a new line.

I saw a similar issue in this thread by another user so I decided to try some of what you asked him to do, with no luck. (disabling the Spam-O-Matic plugin, setting days to check to 1 & 1, etc.)

MySQL Version is 5.5.40-0ubuntu0.14.04.1, and PHP version is 5.5.9-1ubuntu4.5.

The forum itself is a large forum. Over 100,000 accounts are registered and over 1.9 million posts are in the database.

Any suggestions?

EDIT: Just figured it out... Apparently, the file that I uploaded did not have the correct permissions. After setting +rw on the file, it runs as promised and this mod runs now. Sorry about that!

[BJJBJ]

Originally Posted by Kesha

Hey BOP!

I just installed your mod and I'm currently attempting to run it from the Admin CP (Options section) to try it out. I have a private forum set up, which is only accessible by Moderators and Admins. The issue is, when I click the Run Now button, the resulting page is simply "Duplicate IP Report by BOP5" followed by the word "Done" on a new line.

I saw a similar issue in this thread by another user so I decided to try some of what you asked him to do, with no luck. (disabling the Spam-O-Matic plugin, setting days to check to 1 & 1, etc.)

MySQL Version is 5.5.40-0ubuntu0.14.04.1, and PHP version is 5.5.9-1ubuntu4.5.

The forum itself is a large forum. Over 100,000 accounts are registered and over 1.9 million posts are in the database.

Any suggestions?

EDIT: Just figured it out... Apparently, the file that I uploaded did not have the correct permissions. After setting +rw on the file, it runs as promised and this mod runs now. Sorry about that!

I've got the exact same problem as above but his fix didn't work.

[BirdOPrey5]

Originally Posted by BJJBJ

I've got the exact same problem as above but his fix didn't work.

If you are having issue with the Gold version (the free one doesn't have Admin CP interface) please post in the mod thread on qapla.com or PM me on Qapla.com- I can't provide support for the paid mod here on vbulletin.org.

[Kesha]

Just wanted to provide another update. I've had a chance to install and use this mod now, and let me just say that it works surprisingly well with my forum (being a larger forum). The only thing that I wish this modification had, is a duplicate account checker upon registration (with similar style alerts as this mod) but for the price I paid (nothing), this mod does it all for me.

Thank you kindly to BOP5 for this wonderful mod.

[BirdOPrey5]

Originally Posted by Kesha

Just wanted to provide another update. I've had a chance to install and use this mod now, and let me just say that it works surprisingly well with my forum (being a larger forum). The only thing that I wish this modification had, is a duplicate account checker upon registration (with similar style alerts as this mod) but for the price I paid (nothing), this mod does it all for me.

Thank you kindly to BOP5 for this wonderful mod.

Thanks for the kind words. I couldn't "Like" this post because I liked an earlier one. But to your "wishes" if someone registers with an IP address already used (and within the time window specified) they will show up in the report the next say.

If you wanted to actually prevent someone with the same IP from registering again that is possible with the Recent Registration Check mod which is free with the purchase of the paid version of this mod. It doesn't make a report, just blocks the registration (or moderates it) based on your settings.

[Snowhog]

The mod posts the report to a specified Forum. I'd like to be able to choose between posting to a Forum or sending the report to an email address.

[Faskis]

I've found that the scheduled task for this only runs if done manually, but does not run at the scheduled time (it does list a future date/time). I can't find anything about it in the error logs. Any help would be appreciated.