Very large number of 'guests' browsing the forum

[Canal World]

We have noticed we often have a very large number of guess users on the board.


For the last week we have been having issues with hitting the limits of our shared hosting now that our hosts have moved us onto a new server which can monitor and throttle our resource usage.

Obviously we need to move to a more suitable package, and are looking to migrated onto a VPS package shortly but why when there are say 250 users online, do we sometimes have 2000 guest users on the board?
- Clearly some will be members, or the general public, who are viewing the board without signing in. But the rest?

They often appear of an evening, which is clearly also our busiest time when it hits hardest. Are they just web bots? Almost might as well be DOS at times. Is there anyway to manage it, if only until we move onto our VPS server at the start of next week.




Daniel

[SECTalk.com]

It may just be that a lot of your traffic is lurkers. I know 90% of our traffic is not logged in users.

[Canal World]

Its possible, but I'm really not sure we're THAT big!

Rummaging through the stats we also get about 20% of our traffic from China, the Ukraine and India, which appears odd for a forum based on the uk canal system.


Daniel

[3DKiwi]

Check the IP addresses by expanding the list. I had about 300 connections from one UK IP a few days ago. I subsequently blocked it in cPanel. Google is also a problem with their bot appearing multiple times in my user list but I guess I'll have to live with this.

BTW I block all Chinese IP addresses again through cPanel.

[Rhett]

There is a new site reeking havoc on a bunch of customers in the last few weeks, the site is http://ahrefs.com/

Blocking this range will tell them "No thanks, bye bye"

173.199.64.0/18

[3DKiwi]

There is a new site reeking havoc on a bunch of customers in the last few weeks, the site is http://ahrefs.com/

Blocking this range will tell them "No thanks, bye bye"

173.199.64.0/18

Yup, they're there right this minute at my site multiple times. Thanks, they are about to be zapped.

[Canal World]

Do you tend to get a rush of bots just after you have moved server, busily trying to see what's changed? We often have a fair few guests, which obviously some of which will be member/users who are not logged in, but just trying to think why there as been an influx of late.

Short of trawling though the 'show by last click' list is there anyway of getting a neat table of ip's that have been visiting? Another thought is that as the hosts are throttling us causing the site to become briefly inaccessible fairly often at peak times, could that then be cause the same user to be recorded multiple times?

We're running iP.Board 3.1.4 if that is relevant.


Daniel

[IveLeft...]

Another way to block specific countries is if you have Config Server Security and Firewall installed (CSF) with CC_DENY (in WHM - Config Server Security and Firewall > Firewall Configuration) - Make sure the country code is correct or your server will crash on restart

Or in SSH

vi /etc/csf/csf.conf

Find

CC_DENY=""

Replace with

CC_DENY="CN"

CN=China and then add comma for other countries

CC_DENY="CN,SK,TH,RU,VN,UA"

As an example