Domains and IP addresses can be spoofed. What you need to do is create an authentication system. Passive authentication just doesn't work. The obvious caveat is that passive authentication is better than no authentication and crackers typically go after low hanging fruit. However, if they already have handy tools to spoof that information, then they'll use them.

If you show us your code, we may be able to offer some suggestions.

Cheers,
Ovid

New address of my CGI Course.
Silence is Evil (feel free to copy and distribute widely - note copyright text)