Member Tracking and Gumshoe Detective FAQ
The following are frequently asked questions about the Gumshoe Detective report and other member tracking reports.
You can use the Gumshoe Settings page to customize the content of the email that users receive. For more information, including the variables that you can use in Gumshoe emails, see Gumshoe Settings.
We recommend starting with 30 days. This means that an individual person will receive only one email per month. If you specify a shorter time period, such as 7 days, each person who appears on the Gumshoe report in a week would receive an email. This means that individual users will receive more emails, and more users will likely receive emails.
When you set the time period, you can also choose to send emails only to users who repeatedly appear on the report.
First, determine whether the user is accessing Flexmls via a VPN (virtual private network). A VPN can cause a member to falsely appear on the Gumshoe report. If the user is using a VPN, see How does a VPN affect Gumshoe results?.
If you have determined that the user is not accessing Flexmls via a VPN, we recommend that the member change their password immediately. Tell them to set a strong password containing letters, numbers, and special characters (exclamation point (!), at sign (@), pound sign (#), dollar sign ($), percent (%), ampersand (&), asterisk (*), etc.). It's a good idea to use a different trusted computer to change the password, in case the user's computer is infected with malware, a virus, or other problems. The member or a qualified IT professional should check the member's daily-use computer for malicious software, then the member should change the password again.
Next, review the Gumshoe Detective report to find the dates in question. Then run the Login Tracking for Username report for that user on that date. (We recommend printing this report for future reference.) Finally, run the ISPs for Username report for that user for the past month or more. Review with the member which ISPs they have used to access Flexmls. Determine which ISPs may be associated with an attacker, and then block the username from using those ISPs to access Flexmls. For information about setting up access restrictions, see How do I restrict access to an account from specific IP addresses or ISP companies?.
Virtual Private Networks (VPNs) will cause a false positive result on the Gumshoe Detective report. It is difficult to detect when someone is using a VPN, so it can appear as if multiple people are sharing an account. We recommend the following actions:
Ask the member to temporarily stop using a VPN when accessing Flexmls. All Flexmls traffic is encrypted with the latest TLS v1.2 security standard. There is no privacy or security reason to use a VPN with Flexmls. If the member changes their password and stops using the VPN for a month or two, and subsequently drops off the Gumshoe Detective report, it is likely safe to ignore Gumshoe reports for that user.
Ask the member which VPN service they use, and compare with the Login Tracking Report. Usually, you can perform an internet search for the VPN service to determine which ISPs they use, then compare with the Login Tracking for Username report.
If you still suspect the user of sharing their login information, you can use ISP access restrictions. If the member subscribes to a home cable internet service provider (ISP), the MLS can block other ISPs from being used to log in to the account.
The following sequence of events will result in a blocked hit on the Gumshoe Detective report.
A member logs in from one computer.
The member logs in with the same username on a different computer.
The member returns to the first computer, clicks something in Flexmls, and receives the message, "Another person has logged into your account." The click in this step is the blocked hit.
The blocked hit in this example is not breaking account-sharing rules, and will be given a low weight by Gumshoe. However, it will appear on the Gumshoe Detective report if the blocked hit occurs within 5 minutes of a hit from the session in step 2. Gumshoe gives a higher weight to a blocked hit where the user sessions occur on different ISPs, because there is a higher probability that the actions were completed by two different people.
No. The service that is used to geocode a location using an IP address isn't as accurate for wireless providers. The data from a mobile device can travel a long distance on the internal mobile network before arriving at a firewall on the Internet. This means that the IP address from a mobile phone could be from a different city. For this reason, Gumshoe Detective excludes wireless providers, including mobile access cards for laptops, from location checks. However, we can reliably determine ISPs. So a blocked hit between a device on the Verizon Wireless network and a device on the Sprint network is reliable Gumshoe data, but the locations of the two IP addresses are ignored.
Click Change User under Users on the Admin menu. Locate the user that you want to change, then click Edit.
Click the Settings tab and then scroll to the Access Restrictions section of the page.
Choose one of the following options:
Deny Access from the ISPs and IP Addresses below - The member will have "open" access to Flexmls. They can access Flexmls from all ISPs and IP addresses except the ones that you exclude.
Allow Access from only the ISPs and IP Addresses below - The member will have "closed" access to Flexmls. They cannot access Flexmls from any ISPs or IP addresses except the ones that you allow.
Type the name of an ISP from the ISPs for Username report or type an individual IP address. (Note that IP addresses are not as reliable because they change frequently on most Internet connections)
Click the + symbol, then click Save in the upper right corner of the screen.