I have searched & read a couple of similar topics here but did not find an answer so I am starting a new thread.
I moderate a SMF 1.1.13 forum (I tried to post the link here but it kept saying non active when I previewed it). A non-regular member of over 3 years (they have posted 9 times in this time frame from four different IP addresses) has complained that when he goes to log in, he will occasionally get one of our ban trigger messages. We wrote a number of bans mostly by IP and just a few user names or emails. These bans predate his last successful log ins in 2010, which were from the same block he is currently using.
I have checked the ban list and log, and none of his IPs he has used show up on any, nor does his user name or email. In his profile, he does not show as banned. We use an .htaccess list to block certain IPs, but since he is getting one of our custom ban messages, he's hitting a trigger somehow, so it's a ban and not a block.
I asked him to capture his IP when it happened, and he sent it to me today. It is one of the four he has used, and it does not appear anywhere in our ban section.
The member says that if he clears cookies, he is able to log in OK, but then after a while he gets the ban message again.
Thanks for any advice or help.
Some technical details:
The member is posting from 209.65.x.x. I redid our ban trigger messages to list the IP range of the trigger, so the member can forward this to us for identification. The ban trigger he was hitting was 83.170.*.*. I verified it was an active trigger and it only covers 83.170.*.* with no user names or emails in the trigger. I had the member run a traceroute, and none of the IPs listed were on our ban list. None were from the 83. range at all.
Just a possibility, he might be using some form of proxy server or web anonymiser service so that his IP appears different to that which he knows.
Ask him to go to www.ipchicken.com and see what IP that gives him.
Also ask if he's working from a home network or business. Some networks offer "family protection" facilities again which could obscure their IP.
Thank you Chas. One of the first things we had him do was find out what his public IP was. It has been in the 209 range the whole time. We asked if he used a proxy and he said no. The ISP listed for his IP address is in his city. I've not had any further complaints from him, so I'm presuming the lifting of that specific ban block did the trick. I can't really call this one solved though.
I just don't know how an 83 block ban would hit him in the 209 range, and his log ins not show up on our ban log when he was obviously getting the custom ban message I wrote (he gave me the message verbatim, so he was not making anything up which we all know does happen online occasionally :)).
Hopefully this may help another in the future.
is he possibly using a mobile to access the site?
I will ask him & see what he says.
I have had no further complaints, however I don't spend much time moderating that forum anymore. If there had been continued problems, I would have been notified. The causation of the problem remains unknown, but we were able to perform a workaround by lifting one ban trigger.
Alright, I'll mark this solved for now then - Feel free to come back and mark this not solved if the problem comes back :)
For the 7 may, I have also a flock of message errors about visitors who were answered that they are banned.
And they never been banned...
They also appear in the table log_banned.
It seems to me a hacker result, but I have not yet found his way of acting.
The forum is http://deonto-famille.info/ (http://deonto-famille.info/) and it is not protected by CrawlTrack.