Site Management Do you review your site traffic?

[Tracy]

If not... you may want to start. It's a quick way to find out if/when your site is under a DDOS attempt.

I noticed that on my site I had 70 guest visitors (and climbing)... up from the normal 2-5 that I have normally (this does not include known bots).
After watching and checking I discovered that the majority of them were coming out of South America and similar. Odds are it's a BOT attack that someone has hired out.
I went from 600 entries in this CF WAF rule to over a thousand in about 15 minutes.

Some of these passed the CF challenge, so they could be valid, but I generated no new content recently that would be of interest to anyone in South America or that area.
And the solve rate continues to drop but the connections climb. So pretty good idea it is a bot network of some type, as most of the connections appear to be from ISPs in the region which is typical for a bot attack using home users computers. I used CF to check ALL of South America (and a few other individual countries that are doing the same) and use a managed challenge.

Almost every one of them has been a hit on the style path ... misc/style where the style ID and latter sequence of numbers change.

Yes, these could be valid users (but I doubt that many in this short of time) as I do have a new user from Brazil that commented he was going to let some of his friends know about the site.
BUT... I'm getting similar connections out of Russia, Kazahkstan, Pakistan, Moldovia and South Africa.

Just one more reason to use CloudFlare if you don't already. I use the free tier and have had no issues with it, and it's great for blocking/managing stuff like this.

BTW, it climbed to this in the short time I have been writing this messgage.

 

[Nomad]

I review traffic. Sometimes I even build my content strategy based on the what pages my visitors are checking and where my visitors are coming form,

 

[SoluDome]

If not... you may want to start. It's a quick way to find out if/when your site is under a DDOS attempt.

I noticed that on my site I had 70 guest visitors (and climbing)... up from the normal 2-5 that I have normally (this does not include known bots).
After watching and checking I discovered that the majority of them were coming out of South America and similar. Odds are it's a BOT attack that someone has hired out.
I went from 600 entries in this CF WAF rule to over a thousand in about 15 minutes.

View attachment 3832

Some of these passed the CF challenge, so they could be valid, but I generated no new content recently that would be of interest to anyone in South America or that area.
And the solve rate continues to drop but the connections climb. So pretty good idea it is a bot network of some type, as most of the connections appear to be from ISPs in the region which is typical for a bot attack using home users computers. I used CF to check ALL of South America (and a few other individual countries that are doing the same) and use a managed challenge.

Almost every one of them has been a hit on the style path ... misc/style where the style ID and latter sequence of numbers change.

Yes, these could be valid users (but I doubt that many in this short of time) as I do have a new user from Brazil that commented he was going to let some of his friends know about the site.
BUT... I'm getting similar connections out of Russia, Kazahkstan, Pakistan, Moldovia and South Africa.

Just one more reason to use CloudFlare if you don't already. I use the free tier and have had no issues with it, and it's great for blocking/managing stuff like this.

BTW, it climbed to this in the short time I have been writing this messgage.

View attachment 3834

I do this on daily basis! Created one simple rule to block every single robot that i have found while analyzing the traffic. This not just helped in increasing the site performance but also improved user experience on the forum. We block like 62K requests in a single day!

 

[Tracy]

I do this on daily basis! Created one simple rule to block every single robot that i have found while analyzing the traffic. This not just helped in increasing the site performance but also improved user experience on the forum. We block like 62K requests in a single day!

View attachment 4276

Some bots are not bad and you want them hitting your site.
What I referenced are not those type of bots and you have to block them based upon ASN/IP/Country/Region. They generally show as guests in your online user list, so you have to monitor that as most tools in scripts will not catch them.
They are usually part of a botnet that is being ran from consumer computers and they don't announce themselves like Sogu Spyder, GoogleBot and such.

 

[SoluDome]

Some bots are not bad and you want them hitting your site.
What I referenced are not those type of bots and you have to block them based upon ASN/IP/Country/Region. They generally show as guests in your online user list, so you have to monitor that as most tools in scripts will not catch them.
They are usually part of a botnet that is being ran from consumer computers and they don't announce themselves like Sogu Spyder, GoogleBot and such.

We don't block every bot. We just blocked those that are degrading site performance and only on our website to collect data like tiktok, chat gpt bot, ai bots and semrush etc.

 

[zoldos]

I used to, but not lately. I guess I should start?

 

[Tracy]

We don't block every bot. We just blocked those that are degrading site performance and only on our website to collect data like tiktok, chat gpt bot, ai bots and semrush etc.

Once more.. these bots were not reporting as bots. They show as guest users. They have no signature (user agent) that is consistent for a bot that software can catch. So unless you were monitoring for a sudden increase in traffic (visitors) you would never notice them.

 

[Tracy]

Odds are this is something that is in tandem with my recent bounced email increase incidence.
https://admin-junkies.com/threads/xenforo-new-users-and-bounced-emails.14880/

Seems I may have a stalker or twelve.