XF 2.0 users online seeing errors

[diego222]

Hi

Normally I only have 30... 40... maybe 50 users online. Ok... But now suddenly I have more than 100... Then I click on users online and there are a lot of "guests" with the following text under "Guest": "Viewing unknown page - A moment ago"


-To the right of that phrase a triangle icon with exclamation sign "seeing an error"

-When I put mouse over "Unknown page" I see
"XF\Pub\Controller\Error:: DispatchError"

What .... what is this? I can navigate perfectly on the forum, I doesn't see any errors.... is this a "robot" disguised as "guest"? and why is seeing an "error page"?

 

[diego222]

And in apache I see that the pages that are generating errors are:

"/forum/whats-new/update=3427387570454889.5"

 

[Bryan]

I've seen this recently, all IPs were from China and after examining server logs they were trying to access something like ogFoot and ogHead (don't quite remember the exact file).

XenForo handles your 404 errors which is why you are seeing them.

 

[diego222]

In my reply (don't know if you saw it) i say that after taking a look at apache it seems that only ads "update=3427387570454889.5" at the end of the url "Forum/whats-new".

Whats the purpose of this? I mean... they don't "saturate" the forum seeing normal posts... they don't ddos the forum... they only ad that ¿string? to the url

 

[Bryan]

If i add that I just get a 404 error, not sure what its purpose is, I do get a lot of strange GET requests though that do similar things, unless they are hammering I tend to ignore them.

 

[diego222]

I could understand a direct ddos attack to my server... I could understand Google Search Console throwing me errors for unexistant urls (someone write bad my url, etc...)... but .... adding "update=3427387570454889.5" at the end?? And no, no more visits on G. ANalytics, no high load on server, my pages load perfectly fine....

 

[diego222]

GrapeshotCrawler/2.0
MaxPointCrawler/Nutch-1.10
Codewisebot/2.0