Register Members List Search Today's Posts Mark Forums Read

Reply
 
Thread Tools
  #1  
Old 08 Jan 2015, 05:31
WeeeBen WeeeBen is offline
 
Join Date: Jan 2013
a thousand visitors

Is my forum being hacked or something?

I have almost 1000 visitors on my forum, growing every minute.

could this be a problem for my forum?
the forum is running fine it;s just that I average around 50 visitors at a time, to see almost 900 now is a bit worrying, how many more will they do?

Should I be blocking the IP address?

Last edited by WeeeBen; 08 Jan 2015 at 07:38.
Reply With Quote
  #2  
Old 08 Jan 2015, 09:31
ForceHSS's Avatar
ForceHSS ForceHSS is offline
 
Join Date: Apr 2008
Screenshot of online users or at least a link hard to work with nothing
Reply With Quote
  #3  
Old 08 Jan 2015, 09:34
RichieBoy67's Avatar
RichieBoy67 RichieBoy67 is offline
 
Join Date: Apr 2004
Real name: Richie
Most likely search bots and your cache setting being too high.
__________________

Let us take care of your forum, seo, seo reports, maintenance, what ever you need.

Reply With Quote
  #4  
Old 08 Jan 2015, 10:20
Dave Dave is offline
 
Join Date: Jun 2010
Real name: Dave
Either you are being flooded by bots or someone is DDoSing your forum with HTTP GET/POST floods.
__________________
https://technidev.com - security, development, exploits, vBulletin
dave[at]technidev[dot]com

Contact me for custom vBulletin 3/4 work & server/website management.
Reply With Quote
  #5  
Old 08 Jan 2015, 10:35
RichieBoy67's Avatar
RichieBoy67 RichieBoy67 is offline
 
Join Date: Apr 2004
Real name: Richie
Easy check would be to look at your server logs.
__________________

Let us take care of your forum, seo, seo reports, maintenance, what ever you need.

Reply With Quote
  #6  
Old 08 Jan 2015, 10:37
WeeeBen WeeeBen is offline
 
Join Date: Jan 2013
The're all like this..

209.190.82.211
d3.52.be.static.xlhost.com

209.190.82.115
73.52.be.static.xlhost.com

209.190.82.27
1b.52.be.static.xlhost.com

209.190.44.166
a6.2c.be.static.xlhost.com

209.190.43.38
26.2b.be.static.xlhost.com

It went away after an hour but now it's back and even more.

I even reduced cache setting time but there's about 5 different IP's coming in at the same minute, every minute.

Could it have something to do with installing bing ad's? I just did that today but bing send bots already titled bing bot, those IP addresses above don't show they are bots do they?

--------------- Added 08 Jan 2015 at 10:39 ---------------

947 of em now

--------------- Added 08 Jan 2015 at 10:40 ---------------

I contacted my host about them and they say there's no affect to my website.everything still loads up ok.

--------------- Added 08 Jan 2015 at 10:42 ---------------


--------------- Added 08 Jan 2015 at 10:45 ---------------

Originally Posted by RichieBoy67 View Post
Easy check would be to look at your server logs.
I tried that recently about another issue but it was all mumbo jumbo to me.

--------------- Added 08 Jan 2015 at 10:51 ---------------

It's almost like someone's playing a game to get my most ever users to over 1000, I reset it before and now they got it back up to 1000 and appear to be dropping off again.

aside from that I can't see what the point of it is, why would anyone bother doing that?

Last edited by WeeeBen; 09 Jan 2015 at 11:50.
Reply With Quote
  #7  
Old 08 Jan 2015, 11:04
RichieBoy67's Avatar
RichieBoy67 RichieBoy67 is offline
 
Join Date: Apr 2004
Real name: Richie
You really need to see more detail on what they are doing if concerned and you cannot do that without seeing your server logs. Open your log and search for the ips and look to see what the urls they are hitting look like.

If they are doing some kind of a probe you can just ban those ips.

Feel free to post your log here so we can see.
__________________

Let us take care of your forum, seo, seo reports, maintenance, what ever you need.

Reply With Quote
  #8  
Old 08 Jan 2015, 11:18
WeeeBen WeeeBen is offline
 
Join Date: Jan 2013
yeah I can't do it, I tried to save the file and extract it and it ends up as a windows media file.
too complicated for me, guess i'll just have to put up with it.

In the visitor log I can see that each IP goes to a different thread.

--------------- Added 08 Jan 2015 at 11:19 ---------------

There gone now anyway, went from 1090 users to now just 24
Reply With Quote
  #9  
Old 10 Jan 2015, 03:24
ozzy47's Avatar
ozzy47 ozzy47 is offline
 
Join Date: Jul 2009
Real name: Chris
Has this happened again yet?
__________________
You can get access to my 180 mods for vB 3.6 - 4.x at The Admin Zone as well as the professional support you are used to. New vBulletin Spider Definitions, vBulletin Spiders List Hits 1000 Spiders! ​ OzzModz down. Site has had a data breach, checking how the intrusion happened. Change your PW if you use the same one on my site and others.
Reply With Quote
  #10  
Old 12 Jan 2015, 04:48
WeeeBen WeeeBen is offline
 
Join Date: Jan 2013
Happened next day again. They haven't been back like that since but are always online, just a few of them now but constant.

It could of been media.net who do bing ads, they may of been scanning all my pages as I opened up an account at the same time.

I reckon that's who it is since they are still around now, only 3 or 4 though.
Reply With Quote
  #11  
Old 12 Jan 2015, 10:21
ozzy47's Avatar
ozzy47 ozzy47 is offline
 
Join Date: Jul 2009
Real name: Chris
That's quite possible. Thanks for reporting back.
__________________
You can get access to my 180 mods for vB 3.6 - 4.x at The Admin Zone as well as the professional support you are used to. New vBulletin Spider Definitions, vBulletin Spiders List Hits 1000 Spiders! ​ OzzModz down. Site has had a data breach, checking how the intrusion happened. Change your PW if you use the same one on my site and others.
Reply With Quote
  #12  
Old 24 Feb 2015, 22:44
thetechgenius's Avatar
thetechgenius thetechgenius is offline
 
Join Date: Jun 2014
Originally Posted by WeeeBen View Post
The're all like this..

209.190.82.211
d3.52.be.static.xlhost.com

209.190.82.115
73.52.be.static.xlhost.com

209.190.82.27
1b.52.be.static.xlhost.com

209.190.44.166
a6.2c.be.static.xlhost.com

209.190.43.38
26.2b.be.static.xlhost.com

Those Hostnames and IP's are most likely Spam Bots. However, they could be Probes gathering information on your site and/or server to start an attack on your website/server.

I searched that xlhost.com site, and its a Dedicated Server host, they sell dedicated servers and Virtual Private Servers. So its probably someone that is using their services and servers to gather information on your site for an attack (Spam Attack, Bruteforce, DDoS, SQL Injection, etc...). Just Blacklist those IP's and/or the xlhost.com domain hostname.
__________________
TheTechGenius.Net Official IRC Network (ONLINE)
Host: irc.thetechgenius.net
Port: 6667
TTG IRC Web Client - http://thetechgenius.net/irc.html
Reply With Quote
Reply

Similar Threads
Thread Thread Starter Forum Replies Last Post
vBulletin CMS Widgets Flag Counter - Recent Visitors - Top Countries Visitors twizzler vBulletin 4.x Add-ons 5 13 Apr 2011 21:18



Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off


New To Site? Need Help?

All times are GMT. The time now is 04:39.

Layout Options | Width: Wide Color: