Massive increase in Guest users online

lazy llama

Well-known member
I noticed a recent increase in Guest users on the forum I administer.
1758122229542.webp

We're behind Cloudflare, and I'd previously set up some Cloudflare rules to challenge connections from certain countries and ASNs. We also use CFs AI bot blocker etc.
The increased traffic is from multiple IPs, with different user-agents, and the countries vary (Brazil is the source of the highest connections recently).
It's obviously automated traffic, at least to the human eye. Writing rules to filter the traffic is more challenging though.

1758123152860.webp

Cloudflare usually shows us getting around 50-70k unique visitors per day. During these 'spikes' we're getting 10-20x that level.

1758122770807.webp


Looking at the XenForo community current online users, I see a very similar set of figures:
1758122511326.webp

Is anyone else seeing this? Any idea what the purpose is? Is it bad AI bots using a distributed botnet to request pages? It's not causing denial of service, so far at least.
 
They seem to be targeting Xenforo URLs, lots of requests to URLs ending in “/reactions/“ or individual posts by number using “/goto/post?id=“.
By getting Cloudflare rules to challenge requests for those types of URL (combined with some other specific conditions), I’ve reduced guests by 90%.
 
We had a large amount of guests/bots from amazonaws.com yesterday. We block some countries on server but have a lot of different ones today that normally don't show up.

Brazil and Argentina mostly now.
 
Last edited:
Back
Top Bottom