SMF Support > SMF 1.1.x Support

Very sudden "big" increase in visits to the board?

(1/2) > >>

Jill:
Hi,
 Thanks for any suggestions.  Due to the topic of my board and that I am slowly rebuilding it after moving it the SMF until today the most people online at once was about 34.  Out of the blue today it went over 95 so far with No new post etc.  This has me concerned as a big increase in visitors on my last board over a few weeks turned out to be a hack and before long it was over loading the server at I power where I was hosting then and they shut down my board.

Jill

Kill Em All:
Couple possibilities, most likely one would probably a DDoS attack.
http://en.wikipedia.org/wiki/Denial-of-service_attack   -   Wikipedia link if your interested.

Anyways, if you could find out the IP by looking through the logs, you could ask your webhost to block the offending IP(s).

Someone feel free to correct me if I'm wrong, its been awhile :)

Jill:
Thank you Kill Em All,  I think you are right and its a DDOS attack.   I have been tracking the ISP and think I might know where its coming from.   Is there anyway I can block this without my host doing it? 

Jill

Old Fossil:
Quick question if I may.

Jill do you have an antispam mod installed as yet?

MrPhil:
These are "guests" browsing your forum? Be sure to check IP addresses (with whois) to see if these are various search engines that have finally found your forum and are simply indexing it.

If it's just one IP pounding on your forum, it could be a DoS attack, or it could be a bad search engine spider (I think Baidu has a bad reputation for things like this). Some spiders seem to get hung up on pages with forms (e.g., login required) and just sit there burning CPU cycles. Either way, you could put an IP block in your .htaccess file to keep the offender away:

--- Code: ---# block by IP address
order allow,deny
# port scans on PC
deny from 121.12.118.162     <== change
allow from all

--- End code ---

If it's really a severe pounding, you may want to inform your host, so they can put their own block in "further up the food chain" and decrease load on their internal networks. If it's a DDoS attack (many IP addresses attacking, too many for you to individually ban), your host may need to do something.

Navigation

[0] Message Index

[#] Next page