IP of a User

[captainron19]

Need a little assistance. My Super Moderator of my board just received a very abusive PM from a person that just joined the board.

I went into Users in the admin cp and looked up this user and got his IP address.

When I clicked on search IP Addresses and put in this IP it showed the user that sent the abusive PM but much to my surprise it also showed one of my normal registered members that has been with the board for a long time.

Does that mean that this person definitely created an additional username and sent this PM?? I just want to double check before I take any action against him.

I did notice when i searched the IP it is showing (under post IP address) numerous different IP's when I click on "View other IP addresses for this user" but only one IP address for the new registration where the PM came from.

[slappy]

You need to be aware that there are many "shared IP" internet service providers and no absolute way to tell, under such circumstance, whether a particular IP means that the user has more than one registration.

You could ban the particular user and see if there is any more abusive PMs. Since the PM is not "public", perhaps you could suggest that your "Super Mod" simply grow a slightly thicker skin and ignore it, unless it is repeated.

I believe there is a mod available on vBulletin.org which is supposed to attempt to keep track of multiple registrations by users, but I have no idea how effective it may be.

Regards,

[captainron19]

I did a search of the IP and found that it is directly related to Missouri (where my suspicous user lives) I found the IP in a google search as being accessed from the a library in Missouri

[slappy]

If it's from a library, then it is a "public access" computer, which means that "anyone" with access to that computer, who accesses your forums, would have the same IP. This doesn't mean that person who sent the PM was NOT the person you suspect. It's just not conclusive proof that it is the same person, but increases the probability it was the person you suspect.

You could always sent the "suspect" a "warning" about abusing PMs and see how the person responde.

Regards,

[captainron19]

OK here is an update that I could use some input on.

The abusive user signed on today to send her another PM - unfortunately I cannot retrieve the IP in the admin cp when a person sends a pm (Only when they register or make a post)

Luckily when she saw the abusive screen name online she copied the IP Address from the "Who's Online" section.

The IP she saw was...207.119.220.100.dyn.centurytel.net

I searched that IP in the Admin CP and the exact one was not in use but I did find that the suspected user had previously posted in the forum with this IP:

207.119.220.183.dyn.centurytel.net

Any input on this?

[captainron19]

Just an Update

It was the user that I suspected. When I emailed him he fessed up right away because of all of the evidence I presented to him. I deleted him from the system but now he is re-joining and sending threatening PM's to the user he had problems with.

Is there a way I can ban the ip address he is using from joining up any more? Any other suggestions would be helpful.

[leftie]

Try these from vb.org
Miserable user http://www.vbulletin.org/forum/showthread.php?t=121886
Multiple login detector http://www.vbulletin.org/forum/showthread.php?t=125871
I use both to good effect. They won't be 100% as they rely on cookies but they are damn close.

[slappy]

On possibility is to ban the IP using a .htaccess file. Google:

using .htaccess to ban IP

and you will get alot of hits with discussion and code for an .htaccess file which can ban specific IPs.

One sample used:

Files 403.shtml>
order allow,deny
allow from all
</Files>

deny from 69.42.67.196
deny from 4.79.248.8

another:

order allow,deny
deny from xxx.xx.x.x
deny from xxx.xx.x.x
deny from xxx.xx.x.x
allow from all

There are alot of potential choices from the query to your favorite search engine.

Regards,