Stephan Whelan
12-08-2003, 10:27 AM
Our forums - http://forums.deeperblue.net - are seeing some weird behaviour.
About 3 weeks ago the number of guests on our forums seemed to go crazy - we jumped from arodun 20-50 guests at any one time to 200-300. They all seem to be unique IP's, however they only ever seem to look at the Forum Main Index.
About a week later we discovered that our server had been compromised by a hacker with a rootkit and we had to rebuild the whole server. Our ISP (Rackspace) was great in helping with this and we got the server rebuilt and reconfigured within a couple of days.
However the forums still reported large numbers of guests. We have checked our server on a daily basis for compromise now and we know no-one had had unauthorised access to it.
Our website tracking stats (webtrendslive) do not show any increase in number of visitors to the forums, nor does our bandwidth stats show any increase.
Our forums are a hacked version of Vbulletin (hence we can't get official support) 2.2.9 but we hadn't changed any of the code for at least 3 months before this behaviour started...
Does anyone have any ideas?
About 3 weeks ago the number of guests on our forums seemed to go crazy - we jumped from arodun 20-50 guests at any one time to 200-300. They all seem to be unique IP's, however they only ever seem to look at the Forum Main Index.
About a week later we discovered that our server had been compromised by a hacker with a rootkit and we had to rebuild the whole server. Our ISP (Rackspace) was great in helping with this and we got the server rebuilt and reconfigured within a couple of days.
However the forums still reported large numbers of guests. We have checked our server on a daily basis for compromise now and we know no-one had had unauthorised access to it.
Our website tracking stats (webtrendslive) do not show any increase in number of visitors to the forums, nor does our bandwidth stats show any increase.
Our forums are a hacked version of Vbulletin (hence we can't get official support) 2.2.9 but we hadn't changed any of the code for at least 3 months before this behaviour started...
Does anyone have any ideas?