a thousand visitors

[WeeeBen]

Is my forum being hacked or something?

I have almost 1000 visitors on my forum, growing every minute.

could this be a problem for my forum?
the forum is running fine it;s just that I average around 50 visitors at a time, to see almost 900 now is a bit worrying, how many more will they do?

Should I be blocking the IP address?

[ForceHSS]

Screenshot of online users or at least a link hard to work with nothing

[RichieBoy67]

Most likely search bots and your cache setting being too high.

[Dave]

Either you are being flooded by bots or someone is DDoSing your forum with HTTP GET/POST floods.

[RichieBoy67]

Easy check would be to look at your server logs.

[WeeeBen]

The're all like this..

209.190.82.211
d3.52.be.static.xlhost.com

209.190.82.115
73.52.be.static.xlhost.com

209.190.82.27
1b.52.be.static.xlhost.com

209.190.44.166
a6.2c.be.static.xlhost.com

209.190.43.38
26.2b.be.static.xlhost.com

It went away after an hour but now it's back and even more.

I even reduced cache setting time but there's about 5 different IP's coming in at the same minute, every minute.

Could it have something to do with installing bing ad's? I just did that today but bing send bots already titled bing bot, those IP addresses above don't show they are bots do they?

--------------- Added 1420717146 at 1420717146 ---------------

947 of em now

--------------- Added 1420717235 at 1420717235 ---------------

I contacted my host about them and they say there's no affect to my website.everything still loads up ok.

--------------- Added 1420717343 at 1420717343 ---------------


--------------- Added 1420717548 at 1420717548 ---------------

Easy check would be to look at your server logs.

I tried that recently about another issue but it was all mumbo jumbo to me.

--------------- Added 1420717903 at 1420717903 ---------------

It's almost like someone's playing a game to get my most ever users to over 1000, I reset it before and now they got it back up to 1000 and appear to be dropping off again.

aside from that I can't see what the point of it is, why would anyone bother doing that?

[RichieBoy67]

You really need to see more detail on what they are doing if concerned and you cannot do that without seeing your server logs. Open your log and search for the ips and look to see what the urls they are hitting look like.

If they are doing some kind of a probe you can just ban those ips.

Feel free to post your log here so we can see.

[WeeeBen]

yeah I can't do it, I tried to save the file and extract it and it ends up as a windows media file.
too complicated for me, guess i'll just have to put up with it.

In the visitor log I can see that each IP goes to a different thread.

--------------- Added 1420719558 at 1420719558 ---------------

There gone now anyway, went from 1090 users to now just 24

[ozzy47]

Has this happened again yet?

[WeeeBen]

Happened next day again. They haven't been back like that since but are always online, just a few of them now but constant.

It could of been media.net who do bing ads, they may of been scanning all my pages as I opened up an account at the same time.

I reckon that's who it is since they are still around now, only 3 or 4 though.

[ozzy47]

That's quite possible. Thanks for reporting back. :)

[thetechgenius]

The're all like this..

209.190.82.211
d3.52.be.static.xlhost.com

209.190.82.115
73.52.be.static.xlhost.com

209.190.82.27
1b.52.be.static.xlhost.com

209.190.44.166
a6.2c.be.static.xlhost.com

209.190.43.38
26.2b.be.static.xlhost.com



Those Hostnames and IP's are most likely Spam Bots. However, they could be Probes gathering information on your site and/or server to start an attack on your website/server.

I searched that xlhost.com site, and its a Dedicated Server host, they sell dedicated servers and Virtual Private Servers. So its probably someone that is using their services and servers to gather information on your site for an attack (Spam Attack, Bruteforce, DDoS, SQL Injection, etc...). Just Blacklist those IP's and/or the xlhost.com domain hostname.