New Account Email Shows MY server IP Address

Hello,
I have noticed that the email I receive of new account creations shows the IP address of my server. In the past, the IP address of the submitter was captured and displayed. I used that IP addresses captured to block spam registrations. Any idea why I'm not getting this true IP address of the spammer anymore, and what I can do to restore it?

Thanks,

Info at bottom of admin email notification of new account . . .

Office Use Only:
From: jLyAdfEFqUYoWR imFGduRC
Email: bobholahan######################
Login Name: jLyAdfEFqUYoWR imFGduRC
Login Email: bobholahan######################
Telephone: 6334181784
IP Address: 67.20.86.87 - 67.20.86.87
Host Address: 67-20-86-87.unifiedlayer.com
Date and Time: Wed Dec 4 2019 14:17:23 UTC

When you view your store's admin's Tools->Server/Version information, what PHP Version is being used and, when you scroll down that page a bit, what's the Server API?

Is your store's content being served up by a CDN (like CloudFlare)?

PHP is 5.6.40 (Zend: 2.6.0)

Server API is CGI/FastCGI

P.S. No, our site is not using a CDN.

Hi Lat9,

Does the info I provided give you any clue to what's going on?

Thanks,

Greg

I had a similar problem a while back. I traced the issue to a change in how the server handles the HTTP_X_FORWARDED_FOR function. It was assigning my server's ip instead of resolving the client ip past proxies or whatever HTTP_X_FORWARDED_FOR is supposed to do. My host blamed the change on the upgrade to Apache 4.

To fix I had to remove the HTTP_X_FORWARDED_FOR lines from ADMIN/includes/functions/general.php and includes/functions/functions_general.php


here is a related thread that also might help:
https://www.zen-cart.com/showthread....-users-IP-addr

if you want I can copy my exact code changes here for you.

Thanks LightBrown,

I'm trying out those code mods now, will let you know how it works.

LightBrown - problem solved! :clap:

I used your code from the referenced thread as a guide to clear out lines referring to HTTP_X_FORWARDED from

/includes/functions/functions_general.php
and
/{alias}admin/includes/functions/general.php

Now - all references to IP addresses on my site and in admin emails are showing real IP addresses, NOT my server address.

The bogus IP addresses were showing up in the admin -- Whose Online tool. All visitors including spiders were showing as my server's IP address, not their own. When I get abusive spiders, especially from overseas, that hammer my site, I block them via my .htaccess.

Additionally, admin emails notifying of orders and registrations showed my server IP instead of the actual users address. Now, I'll know where they're really coming from, and I can block the danged spam registrations.

Thanks very much for the help!

best,

Greg