The "ip" field used to hold the plain IP address, so it's still called that, even though it now holds a hash. The post() function fills it in like so: $quer

The "ip" field used to hold the plain IP address, so it's still called that, even though it now holds a hash. The post() function fills it in like so: $query->bindValue(':ip', isset($post['ip']) ? $post['ip'] : $identity); It's called from https://github.com/OpenIB/OpenIB/blob/master/post.php#L988 https://github.com/OpenIB/OpenIB/blob/master/post.php#L988, but $post never gets an 'ip' key, so it always uses $identity (which was created using getIdentity(), which currently hashes the IP address). I think the method you describe for checking whether a post could have come from an IP address would work, if they gave up all the relevant salts. secure_trip_salt isn't supposed to change. hashSalt is also needed, because the IDs are generated using the hashed IP addresses, but it's changed infrequently from what I remember (changing it logs out all moderators because sessions are tied to IP addresses, so it's easy to notice).