June 13th, 2013, 02:29 PM
Google hijacking IPs?
I have a problem on a forum where I am a super-moderator and cant find any other reports of it here or elswere online.
What is happening is that in the last few months every new member who registers is shown as having an IP from googles range, 18.104.22.168 is the most common but other 74.125.###.## show up as well. These are all from google HQ in Mountain View, California.
It has now got to the stage where everybody who logs in to the forum is shown as having a google IP from this range.
I myself am shown on the forum at the moment as having logged on from 22.214.171.124 but I know that I am actually on 126.96.36.199 (Whitehaven, Cumbria, UK).
As we use the IP (as well as username and email) to check new registrations against stopforumspam.com then having google IPs for everyone who registers is defeating this check.
Has anybody come across this happening on their website/forum and if so did you find out why it was happening and how to stop it.
For info the forum is run on vBulletin and we have adsense and spam-o-matic running.
I have supermod rights there not admin so will need to pass on any suggestions to the administrator who is also baffled as to why this has suddenly started happening.
June 13th, 2013, 08:25 PM
June 14th, 2013, 07:06 AM
That was one of the first places I searched. I havent posted there yet as I was leaving that to the administrator, Hes the one with the account.
I have also been searching the stopforumspam forum with no joy.
I cant believe we are the only ones seeing this happening, it may be our mistake that somehow everyone visiting our forum is given a google proxy, but a unique mistake?
June 14th, 2013, 09:40 AM
Maybe the datacenter where the server is located is causing the problem. All the traffic flows through their routers.
June 14th, 2013, 12:11 PM
Your previous post prompted me to go back and have another search of the vBulletin forum using different search terms.
I soon found this- http://www.vbulletin.org/forum/showt...ighlight=proxy
This is a vBulletin hack that is needed to pass on the real IP if it is being routed through a server.
It needs to be re-installed every time you upgrade your vBulletin.
It also seems that it can get switched off by pagespeed?
I guess our Admin forgot about it, (easy to do with patches you install once), I have pointed it out to him and hopefully everything will soon be back to normal.
Thanks again for the prompt,
Last edited by nukecad; June 14th, 2013 at 12:26 PM.
June 14th, 2013, 02:09 PM
Great. GLad you got it sorted.
By dcarveror in forum Network Security Discussions
Last Post: August 28th, 2006, 10:30 PM
By weazle fuzion in forum Web Security
Last Post: November 18th, 2003, 07:07 AM
By phaza7 in forum Microsoft Security Discussions
Last Post: October 31st, 2003, 03:20 PM