# Full IP access log
**URL:** https://meta.discourse.org/t/full-ip-access-log/270050
**Category:** Support
**Created:** [June 29, 2023, 4:28pm UTC](https://meta.discourse.org/t/full-ip-access-log/270050 "2023-06-29T16:28:30Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Loki](https://meta.discourse.org/u/Loki)
#### Post date: [June 29, 2023, 4:28pm UTC](https://meta.discourse.org/t/full-ip-access-log/270050/1 "2023-06-29T16:28:30Z")
Is there a log that will tell us _all_ IP addresses every used by a user to log in to our forum? In the User Admin panel, we can see the Last IP and the Reg IP. Is there a way to see a list of **all** IPs from which the user has accessed the site?
---
### Author:  [@not-ethan](https://meta.discourse.org/u/not-ethan)
#### Post date: [June 29, 2023, 10:02pm UTC](https://meta.discourse.org/t/full-ip-access-log/270050/2 "2023-06-29T22:02:54Z")
You can with the [data explorer](https://meta.discourse.org/t/discourse-data-explorer/32566) plugin and this query.
```sql
SELECT id, username, ip_address, registration_ip_address FROM users
```
That will select the id, username, last IP and Reg IP for every user.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [June 29, 2023, 11:37pm UTC](https://meta.discourse.org/t/full-ip-access-log/270050/3 "2023-06-29T23:37:18Z")
> [@Loki](#):
>
> there a log that will tell us _all_ IP addresses every used by a user to log in to our forum?
Only the last ip address is logged.
All ip addresses are in the nginx logs, but figuring out the user will be challenging.
What problem are you trying to solve?
---
### Author:  [@Loki](https://meta.discourse.org/u/Loki)
#### Post date: [June 30, 2023, 10:33am UTC](https://meta.discourse.org/t/full-ip-access-log/270050/4 "2023-06-30T10:33:38Z")
We have lately been getting kinda slammed with new spam probe accounts. They are coming from a range of dynamic IPs in Asia. When a new suspect shows up, occasionally we have caught the current IP as the same as one previously used (using Last IP). But then next time they are on, they may be on a new IP that’s not been used before. Just depends on the timing of when we happen to check.
The next time they are on, may be a different IP that’s not been seen yet. But if we knew that the IP they were on the previous time (after Reg IP but before Last IP), matched one of the other known bad ones, we’d be more confident blocking.
We’ve considered blocking a range of IPs, but need to be careful not to inadvertently block any legit users.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [June 30, 2023, 4:32pm UTC](https://meta.discourse.org/t/full-ip-access-log/270050/5 "2023-06-30T16:32:47Z")
> [@Loki](#):
>
> We’ve considered blocking a range of IPs, but need to be careful not to inadvertently block any legit users.
That was my best idea.
I think just deleting accounts and blocking those IPs as fast as you can is the best you can do without writing a plugin that tracks all IP numbers. People are very concerned about IP tracking, so Discourse keeps only the first and last IP numbers.
But they likely have more IP numbers than you can block one-by-one anyway. Maybe change the TL0 settings so that TL0 can do less and it’s harder to become TL1.