• This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn more.

XF 1.4 Attack of the Google bots?

karll

Well-known member
#1
I'm getting a lot of this: "An unexpected database error occurred. Please try again later." (This is in the browser, while looking at my forum.)

When this happens, my web server log is full of entries like this:
46.36.39.27 - - [18/Dec/2014:23:06:34 +0000] "POST /xmlrpc.php HTTP/1.0" 200 580 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; http://www.google.com/bot.html)"
I'm guessing the Google bots are going bananas (for whatever reason) and are eating up all my database connections. I tried increasing my MySQL max_connections setting slightly, but it didn't help.

Is there a good way to prevent this problem?
 

karll

Well-known member
#2
Ah, this appears to be a Wordpress problem, actually!

Edit: For now I have just disabled my Wordpress site as it wasn't used anyway.
 
Last edited:

Mike

XenForo developer
Staff member
#3
That doesn't appear to be Google, despite the user agent. The IP resolves into this ISP's network: http://www.hukot.net/en/ (some slightly borderline advertising there...). So that's clearly someone spoofing the Google user agent to avoid suspicion. If it's one IP, you should just block it at the server/web server level.
 

karll

Well-known member
#4
Thanks Mike. That is interesting about the spoofing ...! It was multiple different IP addresses.

Looks like the "attack" continued through the night, except now I think my server handled it better (since the xmlrpc.php was no longer available):
198.12.95.206 - - [19/Dec/2014:04:46:05 +0000] "POST /xmlrpc.php HTTP/1.0" 404 493 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; http://www.google.com/bot.html)"
 

Tracy Perry

Well-known member
#5
Is it possible that your WordPress was being used to perform DDOS attacks on others (it's a common WordPress problem that most people that use it don't mitigate).