Originally posted by 8*B@LL


BUT, if the ip/hostname is different but similar and the ID is the same, it may just be the person closing their connection and re-dialing if they are dial-up.
Not necessarily. There are lots of @home users out there who just log on with the default user@ip from mirc, ircle or another irc program. Hence, you'll see lots of [email protected] (an example of one of the subnets). It's very easy to change the ID and information about user.

If someone is looking to see if another person has logged on twice you can use a combination of the techniques above:

1. check for hostname for matches
2. check for ip for matches
3. watch for similar writing style
4. watch for scripts
5. watch exit messages (when the user quits they can put a message in. Many people forget to change this when they are attempting to be someone else).