Local IP instead of Global IP / historic version information?

Recently we got tons of spam initiated by our contact form. Analyzing the historic data I found that all the spam has a Local IP address (192.168.9.162 - the local address of our server) instead of the Global IP. Of course this undermines Visforms anti-spam mechanisms.

I looked into the MySql table of that form and hopped to find version info of Visforms and Joomla core in order to pinpoint whether this malfunction is due to some system update. I did not find such information there. Is there possibly any other (visforms) table from which I could track down if any updates have been installed.

Hi,

I'm sorry for your trouble.

As visForms is just a component inside a greater framework and all tasks of installing, updating etc. are actually done by the framework, it is the responsiblity of the framework to keep track of these things.
visForms does not store update information in the database by itself.

Nevertheless, in order to by better able to fix problem during updates, we have implemented a log mechanismen on visForms installation/update. There should be a log file in the log folder of your Joomla! installation (visforms_update.php) which should contain information about the versions and the times, when the installation/updates were performed. This file does only log information about visForms installations/updates not about Joomla!

Regards,
Aicha

Thank you for this information. I was able to locate a file ' 1.visforms_update.php' in ' \administrator\logs\'. It shows, that the the visforms update was installed 4 days after we had the first wrong IP-address!

If anyone else is stuck by the problem of recent spam: As far as I can track it down (unluckily we deleted 2 backups that possibly would show more information...): It seems that after installation of Joomla 3.9.10 we started to have a local IP-address in all visforms-forms. The same local IP-address was recorded for all hacking attempts (files 'error.php' and '1.error.php'). With installation of Joomla 3.9.15 the problem disappeared regarding the hacking attempts. But we still have the same local IP-address in all filled in visforms-forms. Restarting the website did not help.

I found no hint on such a problem in the Joomla release-notes 3.9.11 .. 3.9.15.

For the moment this behavior remains mysterious. As a workaround I activated the Captcha functionality to stop the spam.

Hi,

thanks for your reply.

I cannot confirm, that a local IP-address is stored with the form data.

I think your problem has something to do with your server configuration...

Regards,
Aicha