User gets blocked on login with log record "66.249.81.13 /login/ Spoofed IP" in case of using Chrome on mobile with "Reduce data usage" turned on.
This should help:
$_SERVER: Array ( [GATEWAY_INTERFACE] => CGI/1.1 [HTTP_ACCEPT] => text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 [HTTP_ACCEPT_ENCODING] => gzip,deflate,sdch [HTTP_ACCEPT_LANGUAGE] => en-US,en;q=0.8,ru;q=0.6,uk;q=0.4 [HTTP_CACHE_CONTROL] => max-age=0 [HTTP_CONNECTION] => Keep-alive [HTTP_COOKIE] => wp-settings-2=tml1%3D2%26tml0%3D0%26editor%3Dhtml%26hidetb%3D1%26galfile%3D1%26galcols%3D2%26galord%3Drand%26imgsize%3Dmedium%26urlbutton%3Dfile%26wplink%3D1%26libraryContent%3Dbrowse%26ed_size%3D647%26align%3Dleft; wp-settings-time-2=1394479711; yaphpbb3_te9sn_u=1; yaphpbb3_te9sn_k=; yaphpbb3_te9sn_sid=[secret]; PHPSESSID=[secret]; __utma=165633335.1598465111.1371411846.1397026545.1397029322.86; __utmc=165633335; __utmz=165633335.1396734173.79.18.utmcsr=plus.url.google.com|utmccn=(referral)|utmcmd=referral|utmcct=/mobileapp [HTTP_FORWARDED] => for=176.96.72.101 [HTTP_HOST] => ya.dn.ua [HTTP_USER_AGENT] => Mozilla/5.0 (Linux; Android 4.4.2; Nexus 4 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.114 Mobile Safari/537.36 [HTTP_VIA] => 1.1 Chrome Compression Proxy [HTTP_X_FORWARDED_FOR] => 176.96.72.101 [PATH] => /bin [PHPRC] => /home/httpd/ya.dn.ua [QUERY_STRING] => [REDIRECT_STATUS] => 200 [REMOTE_ADDR] => 66.249.81.13 [REMOTE_PORT] => 44347 [REQUEST_METHOD] => GET [REQUEST_URI] => /i.php [SCRIPT_NAME] => /i.php [SERVER_ADDR] => 78.47.52.51 [SERVER_ADMIN] => root@localhost [SERVER_PORT] => 80 [SERVER_PROTOCOL] => HTTP/1.1 [SERVER_SIGNATURE] => Apache/2.2.26 (CentOS) Server at ya.dn.ua Port 80 [SERVER_SOFTWARE] => Apache/2.2.26 (CentOS) [PHP_SELF] => /i.php [REQUEST_TIME] => 1397031489 [argv] => Array ( ) [argc] => 0 )
https://wordpress.org/plugins/stop-spammer-registrations-plugin/