Skip to main content

Questions tagged [botattack]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
11 views

loads of random 404s on my site, e.g. /PMG2_00RxzxTHnoN/

Every day we get several hundred 404 errors reported when someone/somebot tries to access seemingly random URLs on our site, eg today we had: /PMG2_00RxzxTHnoN/ /xcUT0qMO9A2omxN-/ /JfqxLE9JNU1bHkI7/ ...
arathra's user avatar
  • 23
0 votes
1 answer
58 views

Website access logs showing abnormal number of single requests from unique ips

I have a website with a around 100k unique pages that are regularly updated. Our search engine rankings have been steadily improving and so has our traffic. Search engines crawl the site constantly ...
Marko1's user avatar
  • 1
1 vote
1 answer
247 views

How can I prevent DOS 404 attacks involving non-existent URLs?

One of my virtual hosts running Apache is experiencing an influx of over 30,000 IP connections attempting to access non-existent URLs. Here's an example log entry: 62.74.16.240 - - [13/Sep/2023:14:24:...
Gold24k's user avatar
  • 19
1 vote
1 answer
120 views

Site search form getting spammed, but by Google IP

I have the search form on a section of a site that is getting bombarded with requests like: search query = baccarat philippe starck furniture, ➡️g188.ph⬅️, play free slots with bonus gcash logo cash, ...
rjbathgate's user avatar
11 votes
4 answers
6k views

Prevent Google from thinking my own bot is faking traffic on my website

I have a large website which I want to be visited by my own bot early on the morning, every day (for caching purpose). I want my bot visits 10,000 pages per day. My natural traffic is about 5000 pages ...
ordiminnie's user avatar
1 vote
1 answer
32 views

How do I identify and block a bot from my site?

In Google Analytics I can see that I started getting traffic to one page on my site, which is /search. It is as if a bot is visiting the site, entering "" in the search bar and pressing ...
John Swain's user avatar
1 vote
1 answer
55 views

Robots visitors to my home page inflating Google Analytics stats

1 to 4 visitors seems to be visiting my site and then returning every few minutes. They are fake (seem like robots). I'm not sure how to get rid of them or filter them out because they are not coming ...
Marco V's user avatar
  • 135
2 votes
1 answer
61 views

Which server status code is appropriate for ugly bots scanning server for vulnerabilities

I have a lot of 404s in my logs for urls like /wp-login, /admin and similar. These are bot attempts to scan the site for vulnerabilities. NOTE: My site is not WP nor has administration under /admin. ...
Jasom Dotnet's user avatar
2 votes
1 answer
70 views

increasing number of malicious login attempts- what to do?

My question is similar to this one, except that the automatted login attempts are using not nonsensical user names, but real ones that were used in the past on this site. It became infected with a ...
Bennypr0fane's user avatar
2 votes
2 answers
1k views

Why is my regional website being hit by thousands of Chinese IP addresses?

For a few days now one of my websites (a local travel guide) has been getting a massive number of hits from Chinese IP addresses. This is to the point that my log files are 10 times bigger and my ...
Chris Leather's user avatar
3 votes
2 answers
446 views

Is it safe to BAN ASN from Hosting providers?

I have some bot problem, i found their ASN and it comes from web hosting providers. Not ISP's. For example: Hetzner: AS24940 Digital Ocean: AS14061 AMAZON-AES: AS14618 Is it safe to ban entire ASN's ...
Michael Rogers's user avatar
2 votes
1 answer
44 views

Random 700% increase on a website hit [closed]

I have a website with a domain that has been registered for around 10 years now the website used to get daily traffic of around 400 to 500 hits per day - but for the past 4 weeks the website users ...
Robert Joodat's user avatar
1 vote
0 answers
17 views

Best resources for learning how to prevent malicious usage? [closed]

I'd like to work on creating a public website, but I'm concerned about the potential for it to be the target of some attack. I'm aware of some of the more common attacks like XSS, query injection, ...
mowwwalker's user avatar
1 vote
0 answers
41 views

Spam boot activities on form inputs [closed]

Spam boot activities on form inputs. Please this question is not on how to protect sites against spam boots via google recaptcha, captchas, maths questions etc. Am wrting to know how spambots ...
jmarkatti's user avatar
  • 111
1 vote
0 answers
106 views

Why would a person or bot visit my "about us" page three times every day?

Something strange happens on my site (which is on 6 languages): I use statcounter for monitoring the website. In the last 3-4 months, I observed that at least 3 times per day, one page is "visited", ...
Petrutech's user avatar
4 votes
1 answer
309 views

Will forbidding "bad bot" user agents via .htaccess add a layer of protection against email address scraping beyond the existing captcha?

I was reviewing the security/protection measures for the websites I manage (one is for a small consulting firm, the other for a not-for-profit art association), and I came across the topic of bad-bot ...
Peter K.'s user avatar
  • 193
2 votes
0 answers
48 views

Can many single page hits from a variety user agents from the same VPN with the same screen resolution be hurting my search rankings?

I am trying to clarify what is happening with the traffic on my site. Lately I am being flooded with many strange hits, mostly from US and they seem to only open 1 page or visit for few seconds. The ...
adrianTNT's user avatar
  • 203
0 votes
1 answer
298 views

Why are bots or servers crawling non- (NEVER) existent URLs and how can I stop this?

Through Google Analytics I started noticing hits in the dozens via a source page named as "free-seo-help.org" that redirects to http://seo2.agri-co-jsy.com/?site=http:// It does not go to my actual ...
Amateur's user avatar
2 votes
0 answers
751 views

What is user agent ;__CT_JOB_ID__:?

I've been searching the web for an explanation of the sudden influx we've gotten of user agents of this format: ;__CT_JOB_ID__:68a72eee-353c-4b0b-82ae-0cb6c8ca3e6e; Each visitor has a unique IP. So ...
A User's user avatar
  • 141
1 vote
0 answers
26 views

What type of IP block rule is used when only the last digits of the IP address of bot traffic are the same?

I have a list of bot (traffic) IPs (around 6000). I'm able to block them when buying traffic to my sites. 193.154.239.54 84.56.102.50 92.105.183.21 193.83.238.7 212.95.5.170 92.211.215.128 93.214.99....
Rubioli's user avatar
  • 111
1 vote
1 answer
3k views

How to block direct traffic spam in Google Analytics?

I am having a problem with my site where I am getting spam direct traffic. I get over 700 "visits" a day with 0% Bounce Rate, 2 pages "visited" (it is the same page listed twice) and every session ...
NDLF's user avatar
  • 11
3 votes
1 answer
1k views

Where can I redirect exploit scanning bots?

I get a lot of those exploit scanning bots like the ones looking for a WordPress login (which I don't have) or guessing other exploitable URLs. Where is a sensible place to redirect them to via ....
Johan's user avatar
  • 31
3 votes
2 answers
804 views

What is adding p, subid, and uid variables to the query string of a site url?

One of our sites is seeing ~100 sessions a day landing on the home page with a query string like the following appended: ?p=1471086892&subid=526&uid=48752857D549575A Each one has the same ...
PeterA's user avatar
  • 141
1 vote
1 answer
70 views

Wordpress security from bots

One of my clients website is getting massive traffic from China most of which are bots. These bots are hitting the site nonstop causing the VM to use very high cpu and memory. As a result it is ...
arifur's user avatar
  • 11
4 votes
1 answer
4k views

Google Analytics traffic surge from China, not real visitor, Baidu?

UPDATE2: Seems this all comes from Baidu crawlers, here's some outputcreated by GoAccess analyzing our logs. We've restricted the the following user-agent which seems to be used by them: Mozilla/5....
Collector's user avatar
  • 269
10 votes
3 answers
994 views

Was user-agent identification used for some scripting attack techique?

Apache access log entries on my site are typically like this one: 207.46.13.174 - - [31/Oct/2016:10:18:55 +0100] "GET /contact HTTP/1.1" 200 256 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www....
miroxlav's user avatar
  • 203
1 vote
1 answer
273 views

Unexplainable non-existing page requested for months

While I am quite familiar with bots requesting well-know pages as used for WordPress and phpMyAdmin on any site the can reach, I'm now dealing with a bot requested a page I really can't explain. For ...
DavidKunz's user avatar
  • 111
3 votes
1 answer
75 views

Website content was copied resulting in decreased traffic

My website with automobile niche has been struggling to stand again plagiarism and bot-attacks from last few months.In last quarter, 3 different domains were setup with exact replica of all the ...
user2756663's user avatar
3 votes
2 answers
208 views

Avoiding downtime after DOS and change of IP

I have a small company designing, programing, and maintaining websites. I host my websites on a shared hosting plan (cpanel). I received an email 2 days ago that there was a DOS attack and the ...
electrique's user avatar
1 vote
1 answer
230 views

Bot POST flood prevention

Since half february I noticed an increase in traffic to a very small website, which started to mail me an access log daily. The bot requests the homepage over and over, posting some content in a form ...
PSZ_Code's user avatar
  • 111
2 votes
1 answer
81 views

wordpress attack?

I have 404 errors on Search Console when queries are being added to my regular URL, such as : &sa=U&ved=0ahUKEwj56v3E9__KAhULbRQKHR3BDggQwW4IHDAD&usg=AFQjCNGDzpx5QNDQ5Kk8NJkIqs048na_tg ...
BernardA's user avatar
  • 189
3 votes
2 answers
168 views

Could we get blacklisted somewhere when our "register" form is abused?

I am on the board of a small sports club. None of us is a professional web master or administrator. A hobbyist club member works as our webmaster in his free time, and none of us knows what to make of ...
rumtscho's user avatar
  • 131
1 vote
2 answers
70 views

Is it a good idea to close the connection on a web hacker / spammer?

When I receive a request from a web spammer, such as a GET /wp-login.php, I am thinking of replying with an error (404) and closing the HTTP connection immediately with this header: Connection: close ...
Alexis Wilke's user avatar
  • 2,247
5 votes
1 answer
967 views

Apparent Bot Impressions in Webmaster Tools

I've been watching some strange stats in Google Webmaster Tools for a particular page on our site, which has been getting some periods of very high impressions but little or no clicks, and then just ...
mikato's user avatar
  • 153
1 vote
4 answers
3k views

What is the best way to detect if the traffic is legit or (bot) not?

We are planning to start program something similar to youtube where users get paid as per views. But problem we are facing is that people will game the system and send traffic using botnets to gain ...
Vivek Sancheti's user avatar
0 votes
0 answers
15 views

spam referers bypass htaccess rules [duplicate]

Here is a sample code I'm using in .htaccess to block spam referers: RewriteEngine On RewriteCond %{HTTP_REFERER} ^http://.*buttons-for-your-website\.com/ [NC,OR] RewriteCond %{HTTP_REFERER} ^http://....
Mina Hafzalla's user avatar
2 votes
3 answers
5k views

How to block a user-agent that has a spacing in its name?

I got a hit from a crawler with a user-agent called DV CRAWLER which is an abvious a spam-bot. I tried to block it in both .htacess and nginx configuration as I'm running nginx as a reverse proxy in ...
Mina Hafzalla's user avatar
1 vote
1 answer
153 views

How to stop parallel downloads

In my server logs I noticed random sets of IP's originating from china that are downloading the same file of about 16MB every couple of hours, and every time the computer downloads it, it starts the ...
Mike -- No longer here's user avatar
2 votes
2 answers
453 views

What is .htaccess rewrite rule for humans.txt in the query string?

From http://www.allthingsdemocrat.com/block-bad-bots-in-htaccess.txt: <IfModule mod_rewrite.c> RewriteCond %{QUERY_STRING} http\:\/\/www\.google\.com\/humans\.txt\? [NC] RewriteRule .* - [F,L] &...
user4951's user avatar
  • 385
0 votes
1 answer
1k views

Am I doing .htaccess right to block google, bing and alexa bots?

I do not need bots at all. I bought my traffic and I do not want my sites to show up on search engine or anything. So I added this: <IfModule mod_setenvif.c> # remove most popular bot ...
user4951's user avatar
  • 385
1 vote
1 answer
80 views

Random (but coherent) text posted from random IP addresses - what kind of attack is that?

My website has a nice by-design anti spam protection. Originaly it was a mistake. What I did is, that every AJAX-submitted <form> has method="get" but AJAX actually uses POST. Thanks ...
Tomáš Zato's user avatar
3 votes
1 answer
307 views

What are these strange Speed_Bump requests in my logs? Malware, nuisance, nothing?

I've recently noticed a number of garbage requests coming into a website that I run. They look like so: 2015-02-19 13:54:27.272 /notify-Speed_Bump?aHR0cDovL3d3dy5zaGFya2FseXRpY3MuY29tLw== 2015-02-19 ...
kriztynna's user avatar
1 vote
2 answers
145 views

Does anybody knows this Bot with UA 'Java/1.7.0_67'?

Does anyone knows this unfriendly Bot coming constantly from this IP-Adress 87.210.90.16 (Amsterdam), UserAgent is 'Java/1.7.0_67' ? It scraped our whole site without any interruption and without to ...
itinance's user avatar
  • 111
0 votes
1 answer
257 views

How to avoid domain removal attacks?

I see on my website log that someone tried the following URL: GET /domainsigma_removal_xxxxxxxxxxxxxxxx.html HTTP/1.1" 404 188 - "Mozilla/5.0 (compatible; OptimizationCrawler/0.2; +http://www....
KJohn's user avatar
  • 1
2 votes
1 answer
77 views

What could be causing heavy bursts of traffic from single IP address to old inactive URL

Looking at Google Analytics recently I noticed a strange phenomenon. For the past few weeks I had 3 unique users making 600 requests for an URL that is not being used anymore. I investigated further ...
Magnus's user avatar
  • 283
8 votes
3 answers
4k views

Why do bots search for / fill and send contact forms?

I'm a bit confused as to why people make bots to do this - is it to find vulnerabilities? I recently upgraded my contact form security with more client and server side validation, including a ...
kcdwayne's user avatar
  • 713
6 votes
2 answers
595 views

80% of Website Traffic coming from Just one Town in USA - Strange?

For the last month, 80% of my total traffic was coming from just one Town in the USA. Here are the attributes: It is one of the richest towns in California in USA which defies logic since I run a ...
user37677's user avatar
1 vote
2 answers
1k views

Do spam bots load the DOM?

I have an issue where a form on my site is getting spammed. The form is actually a copy paste job from a CRM, so I cannot access any of the server side script to make a good human checker. In the ...
MeltingDog's user avatar
  • 1,339
6 votes
1 answer
4k views

How do I capture incoming HTTP requests for analysis?

I have a site that is hit pretty hard by a 'bot script that thinks it is possible to brute-force the Admin password by "trying" out different passwords with the username "Admin". Here is an excerpt ...
Free Radical's user avatar
4 votes
3 answers
1k views

Robots signing up on website

A couple of days ago, some robots started to sign up on the website (about 30 in a couple of days), they don't do anything on the website (as I'm guessing they don't find what they're looking for). I'...
Callombert's user avatar