duplicate ip/password list!

and here it is, finally.. perhaps one of the sweetest hacks i've ever installed.. unfortunately i didn't write it, but wired from http://www.xirgo.com (an awesome host, btw) did, and he gave me permission to release it on here.

this is the duplicate ip/password list hack. this basically shows all duplicate accounts on your vb forum sorted by their ip and/or password. this easily allows you to detect who's really who on your forum, and delete/ban accounts that you think are duplicates.

basically it works like this. there are two parts to this list, one part sorted by duplicate ip, the other part sorted by duplicate password. you can definitely tell users have multiple accounts on your forum if you see two (or more) users both with duplicate ip's AND passwords. this list also lists their post counts and their last visit date, so, if you want to just delete one of someone's duplicate accounts, you can choose to do so by either their last visit date (delete/ban the account that hasn't been on the forum longer), or by their number of posts (delete/ban the account that has the less posts).

please note that NOT ALL duplicate pw's are duplicate accounts, obviously. any user can happen to have the same pw as someone else. i wouldn't recommend deleting people with JUST duplicate pw's, nor with JUST duplicate ip's, because of shared accounts on the same connection, etc., but they can definitely be fishy.

to install this hack, simply put the dupeip.php file into your /admin directory of your vb forum. then to access it, go to yoursite.com/forum/admin/dupeip.php, of course.. that's it! no templates to install, no files to modify!

NOTE: the passwords on the list are in their VB encrypted form, but to be safe, only show this list to the other admins of your forum, although by putting it in your /admin folder it will ask for an admin login anyway.

[Thomas P]

Hi,

very nice hack!

Is there a way to resolve the IPs?

Would be great, having the hostname too would make it easier to say if a duplicate IP happened because of a proxy or a static host...

Thanks anyway,
-Tom

[Jawelin]

I'm looking a way to search for similar usernames and similar email names (first part, till '@')...
SOUNDEX() MySQL function would be nice this matter, but can't manage to GROUP BY a function instead a true table field, as this hack does.

Anyone could help ?
Thanks a lot.
Bye

[Meirion]

Do you have a problem with members registering several names that sound simillar?

In my experience when somebody registers and alternate alias they use a dodgy Hotmail account and a completely different name in order to not be traced.

As for grouping by function, dunno, is there a quick and dirty way of making a temporary table with these results in then doing a standard SELECT with a GROUP on that temp table?

[Meirion]

Originally posted by Thomas P
Is there a way to resolve the IPs?

Would be great, having the hostname too would make it easier to say if a duplicate IP happened because of a proxy or a static host...

I don't think so, as hostname=IP and IP=hostname. You won't reveal any extra information by resolving the IPs, appart from which ISP someone is using.
Unless you mean the opposite, where by resolving IPs will let you see people on dynamic IPs that use the same provider.

[NTLDR]

Originally posted by Meirion
You won't reveal any extra information by resolving the IPs, appart from which ISP someone is using.

You will find out the hostname, which maybe something like proxy.isp.com which is usefull and what Thomas P wanted, so he can see if the multiple IP's are from proxy server and therefore more likly to be legitimate signups.

[Meirion]

Sorry, I thought some more and I understand what you mean now. You mean to prevent accidentally banning someone who ended up having a matching IP due to it being behind a proxy?

[Meirion]

Sorry I was on a bit of a "bust their ass" crusade. I suppose there are some legitimate members out there. I bet my membership would halve if I got rid of all the false names!

[NTLDR]

Originally posted by Meirion
Sorry, I thought some more and I understand what you mean now. You mean to prevent accidentally banning someone who ended up having a matching IP due to it being behind a proxy?

Yep, thats exactly what I mean, I have users who are know are all individuals but have a duplicate IP due to the proxy server they use.

Sorry I was on a bit of a "bust their ass" crusade

lol, no probs, we all get like that at times

[Jawelin]

Originally posted by Meirion
Do you have a problem with members registering several names that sound simillar?

In my experience when somebody registers and alternate alias they use a dodgy Hotmail account and a completely different name in order to not be traced.

As for grouping by function, dunno, is there a quick and dirty way of making a temporary table with these results in then doing a standard SELECT with a GROUP on that temp table?

FoA, thanks for such a fast answer.

Yes, I'm trying to findout possible dupe users (along with ip & pw) by an approximative check of username & email name...
I know well it'd be an 'empiric' way, but not too more than looking for dupe identical password, don't you agree ?

Hwr, a temp table seemed a good solution me too...
But, first I could do a little bit more precise job at php level with lot of memory used to sort the fetch_array; second I wouldn't mess up the db too much creating and destroying temp tables at runtime... Third, I have no idea of the performance and fragmentation impacts such a table could give.


Thank you again.
Bye

[Meirion]

this is what I posted:

I think on my board that hunting for similar sounding names would not prove
fruitful at all.
I suppose it all greatly depends on how many users you have as to the
intensity of an opperation like this. My php & SQL knowledge ends at this
level!

I would much rather concentrate on a script that would use the IPs in the
posts table and look for users using the same IP within a certain time
frame, eg 15 mins. This should catch people out when they change login from
their real name to the false name in order to flame someone.
Obviously doing a search like that on the post table would be a
server-destroying style query, so my plan would be to feed it a user name
that was suspicious. It would then crank back through the last 20 posts of
that user, grab the IPs, then see if anyone had used that IP within 15 mins
of that post time.

Does that make sense? Do you think it would work?