[ONLY TOPIC] Suspicious activity

First topic message reminder :

Technical Details

Forum version : #phpBB3
Position : Founder
Concerned browser(s) : Mozilla Firefox
Who the problem concerns : A few members
When the problem appeared : Today
Forum link : http://freeman-cruisers.forumotion.co.uk/

Description of problem

Hi

I'm afraid this member is having the same issue again

https://help.forumotion.com/t147754-suspicious-activity

Unfortunately he's been out on his boat using BT hotspots which is probably the cause of his issues.

Kind regards

Pat

---

EDIT:
Made only topic by APE

If you are having this same problem please follow this easy step.

if you are having this problem please PM one of the following members of staff
APE  SLGray,  or brandon_g   only Pm one member of staff and if one of the staff are away then tell the new member of staff who you last spoke to so they can look this problem up.


We Thank you for your understanding.

Forum address:
Profile of member:
Email address of member:
IP address of member:
Username of member:

  NOTE : You must fill in this fully or we can not help you as we need this all and it must not be posted on the main forum it must be by PM only.

To get your IP address of the member go to any posts they have made and click on the IP button on the post it will give you a list of IP addresses most of the time it's the first IP address that is banned so we will need that one but we do like to have more then one IP address so we ask you to give at least 5 of them.

To get the profile of the member just click on the name of the member on your forum and then copy the URL of that page.

Who

I have merged all topic's on to one as they are all the same problem.

and from now on i will post my report here when the usernames have been cleared.

Please remember that after you have reported your members to staff your members must not try and log in until we report back and they must clear the browsers before logging on to your forum.

@Prof Pat Pending your problem should be fixed now.

Can you let us know if you still have a problem ?

Unfortunately he's still locked out

Prof Pat Pending wrote:Unfortunately he's still locked out

ok can you send me the last 4 IP addresses that member used by PM and i will try again

Unfortunately I have the same problem on my forum
User Name: Text removed
Forum address
email:Text removed
Text removed


Please can this fixed? Many thanks

Kalliopi

I have a couple of members with BT email addresses having the same problem. APE I have sent you a pm.

Kalliopi wrote:TEXT REMOVED
DON'T Post this sort of thing in the main forum.


Please can this fixed? Many thanks

Kalliopi

Hello @Kalliopi Please don't post the IP address and info on the main forum you must read the posts i have sent to you all .

you need to PM me this data from now on

I have sent your request online now but makes sure from now on you only PM staff members with this data from now on as posting this is not safe on the main forum

TimV wrote:I have a couple of members with BT email addresses having the same problem. APE I have sent you a pm.

Thank you for your PM i have got it but as you have not sent me all the data i can not help.

You need to PM me all of the data i have asked for in the posts i made

you need to do this for each member blocked.

Forum address:
Profile of member:
Email address of member:
IP address of member:
Username of member:

once i have this data i can send the report off and have them removed.

This must be sent by PM only.

@baldy  Username: June is 
@Tansy Firedragon  Username: HeatherD is 
@LadySibella  Username: Snowy is 
@llamafish all of your's have been
@Seriously all of your's have been
@Prof Pat Pending Username: Stephen Your request is

Thanks so much Ape! I'm gonna contact my member to let her know and will get back to you to let you know if it worked for her

@Kalliopi Username: skip is 

@FallonRPG  Username: Caitlin is 
Updated : now

@Prof Pat Pending Username: Stephen can you please ask your member to try again.

@FallonRPG  Username: Caitlin is 

APE wrote:@Prof Pat Pending Username: Stephen can you please ask your member to try again.

Still locked out I'm afraid

@ape

Neither one can log in still. I asked them to clear their cache on all their devices before attempting to log in.

I've checked their accounts and they haven't posted anything that would go against TOS as well. All of the members currently affected are from the U.K. and use the same service provider. They've also all probably used the same public wifi access points around the country.

Is any of that information helpful as to why they're being locked out?

Seriously wrote:@ape

Neither one can log in still. I asked them to clear their cache on all their devices before attempting to log in.

I've checked their accounts and they haven't posted anything that would go against TOS as well. All of the members currently affected are from the U.K. and use the same service provider. They've also all probably used the same public wifi access points around the country.

Is any of that information helpful as to why they're being locked out?

Hello @Seriously

It has Nothing to do with the TOS.

Your member has logged in on your forum with a number of IP addresses this then set's off a IP ban on the account.
This is done our end as it see's the account as maybe a bot or a spam account so our system stops them using the account.

what we have to do is remove your member from the banned Account on our servers and remove the listed IP Addresses.

Now the only staff that can do that is the ones that work in our head office in france.

Sadly the system can hold 1000's of IP addresses for just one member and we need to find the right IP address banned on the system.

Right now our head office is now closed for the weekend and we will make a report but it will not be seen until monday the latest.

you need to send me a new PM with the last 5 IP Addresses with the username and the forum address i will then make a new report.

if you have more then one member banned your have to send me a new pm for each of them so i can make sure they each have there own report.

I'm really confused by that, because I have loads of members who have 10+ IP addresses attached to their accounts from logging into the forum in various places during their daily routines and aren't having this issue. (We have 15k+ members.)

Now all of a sudden this week people are getting locked out of the forum left and right. About 5 days ago we only had 2 people have this issue, yesterday we had 4, and just today 2 more people said they were locked out of their accounts within the last couple of hours. I've started going around asking if others are having the issue and I expect more people to make a complaint about this because they didn't expect it to be an issue on forumotion/onlineguardian's end.

One of the accounts that are receiving the suspicious activity message only has two IP address' attached to it and has no others come up when I do an IP check on them, so I'm having a hard time believing your excuse that multiple IPs are the only thing triggering these events.

Edit: I just received a direct message on discord from another member who was just locked out of her account not even 30mins ago with the suspicious activity message. She's been on the forum since 2012 and only has 4 IP addresses attached to her account. What is going on??

Again, ALL of these people are from the UK and ALL of these people use the same internet service providers (BT Broadband / BT Central Plus) and hotspots that the ISP has around the country. ???? It's no longer a coincidence when all members affected are from the same area and have the same provider.

BT have a big problem and so dose some other providers like sky and Plus net and i think the other one is talk talk .

The problem comes when they all have rolling Ip addresses and every time you log off of your computer and turn off your modems they give you a new IP address now our system reads that change and looks at it as a web bot or spammer Now say your member logs in 3 times in the day and the IP address was to change like it dose then our system looks at the account and flags it on our servers.

Now the next day they log in say 2 times with a new IP address it then looks to see if the IP address is the same again.

Now if your member logs in say 15 times in one week and the IP address is not the same it will flag again up again. Now this time it thinks ok now this is not right and then places the account on our system as a spammer .

for the last 6 years this has always been the same and it's nothing new

last year i made a report about the same thing and most of the members will remember this.

Now this is not a problem to most members as they use the same Ip address sadly there is nothing we can do about it as they will not give all there members a static IP address but you can call them up and ask for one.

The problem is BT / Plusnet / sky and talk talk in the uk say they can't give a static IP address but they can .... but it cost them to do so That's why they don't like to give them out.

Trust me the system they use is crap and outdated but until they fix it there is nothing we can do.

our system is one of the best out there and we always try new things and sadly it's this system or nothing and then your forum will be full of bots/ spammers and your be asking us to do something.

I work for virgin mobile and i know that BT and other UK systems use this system
With Virgin we only give 3 IP addresses a month or when your reboot your Modem.

This is called a static IP address and this is why your account is not flagged up

now all over the world not just the uk they have the same thing.

BT / Plusnet /sky and talk talk are all hosted by a BT phone line and all come from the same system and will always use a rolling IP address that is why the system is picking up more uk hosted Ip's

we will work hard to getting your members removed but this can take time and working over your IP addresses but remember it's all done by one person in our head office so it can take some time to clear the accounts and not always will we get it right first time.

some times more then one Ip address can be banned and we have to pick them out of a list of 5 or more per person

I'm by no means disrespecting the people who are working to fix this, including you, I just wouldn't understand why a company this day and age wouldn't give static IPs to residential customers, or at least dynamic IPs that don't switch as often? That's total bullocks and crap for all our members in the UK. I have a feeling we're going to get flooded with more of these requests here soon because not a day has gone by so far this week that someone new hasn't come up to me and said they've been locked out.

I'll send all the info to you again, including the new information.

+ If they delete their account and create a new one, will that resolve the issue?

Seriously wrote:

+ If they delete their account and create a new one, will that resolve the issue?

No that will not make a blind bit of defence.

the Ip addresses will still be blocked on our system and the account will still be the same as it was before it is saved our end on our servers . so just removing the account as a member will just mess things up more.

Today and last night i had over 20 members make a report to me about the same problem and NO not all of them are UK basted some was in the USA so its not just BT and UK stuff we have to deal with.

now as i have said i need the full info and each member needs to be named and each one has to be sent a s a single PM so i can make sure each one is reported as one person,

Now the best way to do this is go in your members post click on the IP address button and read the first 5 Ip addresses That will give me the IP addresses that may have been banned on our servers.

There is no need to ask your members to look the IP address up on the computer as that will be a NEW ip addresses that is not banned at this time.

Now if you member keeps logging on and getting the warning then the ip address will not link to your accounts.

so you member is asked NOT to try and log in until we ask them to do so.

So to be 100% clear:
we need a new PM with

Username:
last 5 ip addresses: "1st one to last one"
Forum link:
members profile:
founders name:

Now you have to make a new PM for each member not all in one as we use a tool that can only list one member at a time.

APE wrote:@baldy  Username: June is 
@Tansy Firedragon  Username: HeatherD is 
@LadySibella  Username: Snowy is 
@llamafish all of your's have been
@Seriously all of your's have been
@Prof Pat Pending Username: Stephen Your request is

I am afraid that June is still unable to login Ape

As a Talk Talk customer, I'm now a little concerned.

If I get locked out of my forum, I assume that I'll also be locked out of this forum.
How would I then report that to you

Sorry APE but HeatherD is still unable to log in - still getting the suspicious activity message.
For reference she has been a member of our forum for over two years, always with the same email address (BT) but not had this problem before, it only arose when she ran an Windows 10 update - could this have had an effect?



@APE wrote:
@baldy Username: June is
@Tansy Firedragon Username: HeatherD is
@LadySibella Username: Snowy is
@llamafish all of your's have been
@Seriously all of your's have been
@Prof Pat Pending Username: Stephen Your request is

@APE pm sent - thank you.

@APE Just heard from my member, she did do everything, clearing cache, history, etc, before logging in.
She can't get in, still getting same issue.

APE wrote:@baldy  Username: June is 
@Tansy Firedragon  Username: HeatherD is 
@LadySibella  Username: Snowy is 
@llamafish all of your's have been
@Seriously all of your's have been
@Prof Pat Pending Username: Stephen Your request is

ok i have made a fresh report for you all as it's now the weekend our office is shut but i have made the report today.

the following members i have listed on my tools are
@TimV
@baldy
@llamafish
@Ronnytigs
@Prof Pat Pending

all of you are listed as

if i have missed anyone Please tag me here as you can tell i have lots listed and i have asked that the head office get back to me on this as soon as they can.

We are sorry for the delay in getting this fixed and i will do my best to get back to you as fast as i can.

Oh Great! Another issue that is going to take more of our time fixing! I have no clue yet how many of our members could be involved. Currently only one has managed to get word to me about this issue. He can get in on his cellphone, but not his laptop computer at home. So I have to try and figure out an ip that corresponds to his laptop to send in the PM to you guys.

I know it's easy to blame some service providers. But this was not an issue. Which means Forumotion HAS DONE SOMETHING to change things.

Expect a PM. Or many PM's. Depending on the number of users involved. And as I can find time to deal with it. I am not angry with you Ape. But I am frustrated with how Forumotion has chosen to deal with this problem.

@BucolicBuffalo It is better to send me 1 pm per member that is blocked then i know i will not miss any of them out.

As you may know all the staff here are volunteers all but 2 of them The Godfather and Shadow. so we all do what we can to help when the head office is closed.

I know how you feel when things like this come to light and i understand your frustration on this matter and i feel the same as you do about how this anti spam system works but it is there to help cut down hackers, spammers and rogue account's.