Botnet attack

[psyhyatr]

how i can block this shit?? i have 2200 bots online and this get down my site because overloading hosting server..:confused:

p.s. sry for my english

[Dave]

You can try this https://vborg.vbsupport.ru/showthread.php?t=268208.
Do you happen to know what kind of bots? What's the useragent of those bots?

[edgeless]

If the first 2 or 3 octets of the unwanted clients' IPs are always the same, you can ban the IP range via your vBulletin ACP. For example, if a large number of the bots/spiders are using IPs that begin with 188.165 ... you simply go to ACP > Settings > Options > User Banning Options and add 188.165 to the Banned IP Addresses list and click the Save button. It will take a while before the bot instances vanish from your Who's Online list since they have already established a connection to your server. But once they drop off they won't be able to reconnect using the same IP range.

Another option to try a user agent banning add-on like the one Dave suggested, but that's not likely to work too well if most of the offending bots are connecting as "Guest". If an add-on is banning by user agent and you tell it to ban all "Guest" connections, then it would presumably keep all unregistered users from connecting to your forum site. And that likely wouldn't be a very good situation.

Yet another option is to ban the bots manually by user agent. To do this, create (or edit if it allready exists) a robots.txt file in your forum's root directory. Within that file, add the exact user agents that you wish to ban, like so:

User-agent: Baiduspider
Disallow: /

User-agent: Baiduspider-mobile
Disallow: /

User-agent: Baiduspider-image
Disallow: /

User-agent: Baiduspider-video
Disallow: /

User-agent: Baiduspider-news
Disallow: /

User-agent: Baiduspider-favo
Disallow: /

User-agent: Baiduspider-ads
Disallow: /

User-agent: Baiduspider-cpro
Disallow: /

then save the file. This will ban all of the Baiduspider user agent groups listed. I expect that's what the add-on suggested by Dave is actually doing.

The last option is only possible if you have root access to the hosting server (dedi or vps). That would be to ban the offending IP ranges at your operating system's filtering/firewall system level. If you can do that, your forum software won't ever see the connection attempts that you've blocked.

[psyhyatr]

thank you very much to all ! perfect !