Is there a log that will tell us all IP addresses every used by a user to log in to our forum? In the User Admin panel, we can see the Last IP and the Reg IP. Is there a way to see a list of all IPs from which the user has accessed the site?
You can with the data explorer plugin and this query.
SELECT id, username, ip_address, registration_ip_address FROM users
That will select the id, username, last IP and Reg IP for every user.
Only the last ip address is logged.
All ip addresses are in the nginx logs, but figuring out the user will be challenging.
What problem are you trying to solve?
2 Likes
We have lately been getting kinda slammed with new spam probe accounts. They are coming from a range of dynamic IPs in Asia. When a new suspect shows up, occasionally we have caught the current IP as the same as one previously used (using Last IP). But then next time they are on, they may be on a new IP that’s not been used before. Just depends on the timing of when we happen to check.
The next time they are on, may be a different IP that’s not been seen yet. But if we knew that the IP they were on the previous time (after Reg IP but before Last IP), matched one of the other known bad ones, we’d be more confident blocking.
We’ve considered blocking a range of IPs, but need to be careful not to inadvertently block any legit users.
That was my best idea.
I think just deleting accounts and blocking those IPs as fast as you can is the best you can do without writing a plugin that tracks all IP numbers. People are very concerned about IP tracking, so Discourse keeps only the first and last IP numbers.
But they likely have more IP numbers than you can block one-by-one anyway. Maybe change the TL0 settings so that TL0 can do less and it’s harder to become TL1.
2 Likes