i was detected a way for this :
1- with phpmyadmin go to installed oxwall database > go to: ow_base_user table and then go to wanted user's row! (you can search wanted user's username in this table for this work!)
2- on wanted user's row, click on edit and then find joinIp field
3- copy joinIp value (it is unsigned!)
4- go to this site,
5- in IP Address from integer section, paste joinIp value and click on convert button!
Now you have your wanted user's real ip and you can block he/she by the server or by watch dog plugin!