users IP

I believe this plugin will help with that: https://www.ads-software.com/plugins/banhammer/

Thankyou very much James, I’m installing it now.But it seems that this great plugin will ban any future user. I did not read the tutorial yet, but what we need is a way to read the Ip of the user which is already subscribed, to prove that he is this guy (we are sure).
Do you think that this plugin could help me to find that IP?
The guy is clever: he subscribes with several bad names, but always anonimous: his way to disturb is not to write messages:
his “messages” (offenses) are in the user name, he will never send a message to avoid to be catched (f.e. a nickname is “fuckyou”).
But the next time he will not use the same: he will apply a new subscription.
A couple per day.
Hope to have clearly explained the situ: I must “lock the person with Authorities”, because banning hinm few times per day is not enough (he will continue).

(to better explain: he is a stalker of my wife, psyco and with already several legal action from her: sorry if me and my wife explained the personal case)

Do you think that this plugin could help me to find that IP?

The plugin above tracks all IP activity, so you should be able to narrow it down by comparing registration times and other activity.

You should also be able to do the same comparison with your server access logs. (check your hosting provider’s documentation for specifics)

Oh, I forgot about https://www.ads-software.com/plugins/aryo-activity-log/ that’s probably more like what you need. ??

Great! thank you we appreciate your help a lot!
Mauro & Stefania

There are literally hundreds of thousands of available anonymous proxies, VPNs, Tor etc that an abusive user can use to access your website.

Many of these types of spam attacks are automated and use extensive proxy lists in a toggling pseudo-random fashion.

Only on very rare occasions is it an individual who is directly targeting your website. It could well be the case in your instance, as it is unusual for spammers to use usernames that stand out.

If it is however an automated registration method, there are many plugins that solve that issue by making it very difficult for a server to automatically register on your website.

Te_Taipo, thank you for your kind advice too!
Unfortunately behind this there is an horrible story (which I don’t want to bother you writing here) … but I’m 99% sure that this is not a spamming coincidence.
This psyco is persecuting my wife and (for exa,ple) sent 1878 hard offensive messages just on whatsapp, he shadows her when she is alone, etc..
Police found also a gun at his home: we sent them after his threats against me.
And the event is:
“the site is not finished yet, and I’m putting it online just sometime for tests”: and in those minutes appear the new users.

Sorry for the sad story.

PS: I have also another question regarding WP updates, but I’m new here: can I put on this thread or change to a new one? Thanks and sorry.
Mauro

@mrosfy Thanks for that, a little context does go a long way. Yes that does sound more like its a targeted attack. If its forensics of sorts that you need then there are plenty of plugins that offer IP logging of one form or another.

Once you have the IP addresses you can look them up on many web services that allow you to check their DNS, whether they are Tor, VPN or proxies etc. If the attacker is using such services then tracking via IPs rendered rather useless.

As an aside though it is still possible that this type of attack is automated in one form or another. It is not completely unusual for activity to begin on your new WP install shortly after installing. Spam servers are continually scanning for new installations as they are the least likely to be completely configured against spam.

Thank you Te-Taipo, your advices are useful for me.
I will do some test, then (if I don’t disturb) might be I will have to ask you a point of view. For now what I see is that when I install the aryo-activity-log it doesn’t see the new “users”, or ot sees with our same IP.
In other words the report is our avatar + the nick name of these users + our IP address.
But this might be because days ago I changed the “guests” role from subscriber to “none”, and today to check I changed again to subscriber

Thank you to all.
Mauro & Stefania