Most Online - has anybody seen this?

[shawnb61]

We had a massive shift in our 'most online' count recently.   Our 'most online' figure has been ~150, but recently jumped to 2278 on one day.  We tend to hover ~90-120 most online every day, mostly guests. 

What are potential causes?   Runaway crawler?  DDoS attack?   Host goofing up sessions?  I'm at a loss.  I don't have any social media mods.

The forum has been humming along fine.  One of the forum's members pointed this out, it's reported at the bottom of the main page.

Forum version:  2.0.13. 

Mods: 
1   SMF 2.0.11 Update   1.0
2   SMF 2.0.4 Update   1.0
3   Search Focus Dropdown   1.6.1
4   SMF 2.0.8 Update   1.0
5   httpBL   2.5.1
6   Global Headers Footers   2.0.1
7   SMF 2.0.3 Update   1.0
8   Forum Firewall   2.0.0
9   SMF 2.0.12 Update   1.0
10   Like Posts   2.0.5
11   SMF 1.1.20 / 2.0.9 Update   1.0
12   Stop Forum Spam   1.0
13   SMF 1.1.21 / 2.0.10 Update   1.0
14   More Spiders   1.2
15   Bookmarks   2.5
16   Stop Spammer   2.3.9
17   SMF 2.0.5 Update   1.0
18   SMF 2.0.7 Update   1.0
19   Customize *Child Board*   2.7
20   SMF 1.1.19 / 2.0.6 Update   1.0
21   Responsive Curve   1.0.0
22   Downloads System   2.6
23   Join Reason   1.5
24   Remove images from quotes   1.6
25   SMF 2.0.13 Update   1.0
26   Simple Audio Video Embedder   4.0.1
27   SMF 2.0.2 Update   1.0

[Looking]

Probably bots and spiders. Lots of servers out there have them making coordinated attacks or sniffing.

[Shambles]

My guess is that one of your admins - unbeknownst to you - temporarily altered the users online threshold from your current 15 minutes to 1440 minutes, which would inflate the number of members recorded as being online during that whole period.

[shawnb61]

Hmmm...  Our admin log doesn't note ANY such changes in that timeframe. 

Good thought though...

I suspect a bot also.   

[Shambles]

That change won't be recorded in the Admin log.

[Illori]

we can guess all day, but there is really no way to know what caused the number to rise.

[shawnb61]

Thanks for the input, all. 

There is nothing unusual about that day, statistically, from bots or users, that I can see in the raw access logs.

Thus, I suspect some variation on what Shambles said - that sessions were held unusually long somehow. 

(The logs are always a bit of a rabbithole...  E.g., there was a "COOK" issued from a university in Seoul on 2/10...   ) 

Illori's right, probably nothing more to be learned here.