I'd like to state for the record that your firewall on your server sucks, HTTP_X_FORWARDED_FOR should always translate to the real user IP address, lol.
Of course, I'll be happy to mention that to Sucuri. Especially as they are supposed to be professionals in their field.
Thank you Gizmo, I'll try this and get back to you.
