XF 1.4 Attack of the Google bots?

[karll]

I'm getting a lot of this: "An unexpected database error occurred. Please try again later." (This is in the browser, while looking at my forum.)

When this happens, my web server log is full of entries like this:

46.36.39.27 - - [18/Dec/2014:23:06:34 +0000] "POST /xmlrpc.php HTTP/1.0" 200 580 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; http://www.google.com/bot.html)"

I'm guessing the Google bots are going bananas (for whatever reason) and are eating up all my database connections. I tried increasing my MySQL max_connections setting slightly, but it didn't help.

Is there a good way to prevent this problem?

 

[karll]

Ah, this appears to be a Wordpress problem, actually!

Edit: For now I have just disabled my Wordpress site as it wasn't used anyway.

 

[Mike]

That doesn't appear to be Google, despite the user agent. The IP resolves into this ISP's network: http://www.hukot.net/en/ (some slightly borderline advertising there...). So that's clearly someone spoofing the Google user agent to avoid suspicion. If it's one IP, you should just block it at the server/web server level.

 

[karll]

Thanks Mike. That is interesting about the spoofing ...! It was multiple different IP addresses.

Looks like the "attack" continued through the night, except now I think my server handled it better (since the xmlrpc.php was no longer available):

198.12.95.206 - - [19/Dec/2014:04:46:05 +0000] "POST /xmlrpc.php HTTP/1.0" 404 493 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; http://www.google.com/bot.html)"

 

[TPerry]

Is it possible that your WordPress was being used to perform DDOS attacks on others (it's a common WordPress problem that most people that use it don't mitigate).