Search for special IP someone posted with

[Angelus]

Hi. Someone is obviously trying to hack my board. He tries to log in as a user several times and than the account is locked. Than I get an email with his IP. Can I check If there was a User of my board having this IP in the past? In Postings the IP is stored but I did not found where to look for a IP and get back the postings written with this IP.

In the db the IP is crypted. To check every 10000 Postings by hand is little much work.

Hope someone can help me.

Greetings
Thorstne

[Adrian Rea]

I think the IP is in hex format, there must be converters out there, and there is an ip search in hex. want me to look? you can pm me details I can look tomorrow afrternoon.

A

[Angelus]

I found out how it works. I have to go to User Admin-> IP Search. If someone has posted with the IP an account was locked with I will see it there. But unfortunately nobody posted with any of the hackers IP. But it is possible that the hacker is a member. A user having a locked account about 15 times in the last 2 days has some friends at the police probably able to check the ips because they seem to be German ones.

So because the IPs of logged in users are probably not stored (only if a users does a post his IP is stored) I think this topic can be marked as Solved?

Greetings
Thorsten

[Adrian Rea]

you still have the problem tho?

I did find this useful converter
http://www.kloth.net/services/iplocate.php

Let us know if you are still being hacked.

A

[Angelus]

Thanks this will probably help. But the IP Search does its work well.

The hacker seems to be no right hacker. He only seems to enter the password false. And this he does to several users. So I have a couple of users that have to reactivate their accounts using their security question. But some can't login. They are redirected to the portal but without being logged on. One user deleted his cookies and everything was fine. Another using opera is till searching where to delete cookies <img>. A trhird has also a problem but still not specified the problem enough to help. I do noting else than reactivating accounts or give new passwords or reset security questions in the last hours.

But obviously a couple of boards with similar content were hacked or al least some tried to.

Can I remove admin rights in my forum?

Greetings
Thorsten

[Adrian Rea]

I have thought of a couple of things to try,
1) change the cookie name in ACP> General Admin> Configuration
2) Go to ACP> Security>Configuration and set login attempts to 100 or eve 1000 to increase the hackers frustration. I do not see a way to disable the login attempts by a 0 or -1, perhaps we need that feature.

Hope these help.

A

[Angelus]

Thanks Adrian. Will probably do so.

Greetings
Thorsten