Urgent help needed!!

[iHatton]

Hello,

This is urgent.

I received threats by someone that my forum is going to be hacked (http://pigfire.com) and I think they did ddos it.

Once the website came back up, I have 66 guests online and 1 member.
the 1 member being me.

As my forum opened 2 days ago, I only expect there to be about 5 members and 2 guests online at this time.

Are those guests really legit and are actual people coming to my forum? Or are those the connections from ddos?

I want to put it back to normal because I think they messed it up.

I upgraded to 3.8.4 after it happened to see if the Users Online went back to normal and it didn't.

How can I put it back to normal if it isn't legit connections?

[genesisdnb]

Have your checked the IP's in the whos' online bit? there probably just spiders

[iHatton]

I did, and I got 21 connections from the same IP address.

[genesisdnb]

did you google the IP?

[iHatton]

I did, and there ISPs are BlueYonder and BellSouth.

So far, I received about 400 connections from these now.

Theres about 15 different IP addresses now, each with about 30 connections.

[genesisdnb]

Sounds like the aftermath of a DDoS attack

[iHatton]

I put their IP addresses in .htcaccess, using this layout :
order allow,deny
deny from 82.xx.xx.xx
allow from all

That would ban them right?

[Lynne]

That would be correct (assuming you are putting numbers in where the xxs are). You could also do 82.xx.xx. Take a look at this (near the bottom) - How To Block Bots, Ban IP Addresses With .htaccess (http://blamcast.net/articles/block-bots-hotlinking-ban-ip-htaccess)

[iHatton]

I already have them, instead I got a full list of about 50 bots to block.

Is there like a script anywhere to block connections if they have 3 or more open on there computer?