Hosting Question

[mopek1]

Hey,

I wanted to get your opinions on something.

I've been seeing a tiny lag in my site's loading time, usually in the morning and only for a few seconds at a time. It is intermittent, meaning 5 minutes of normal behavior and then the pages load slowly for about 20 seconds and then back to normal.

My host said the network seems fine but they have noticed that there are a handful of IPs that have multiple hundreds of connections each.

They took my server offline for a bit to check something and when it came back on the CPU usage was through the roof with those same IPs - about 10 to 20 of them - immediately connecting again with multiple hundreds of connections.

They said they don't know if those are legit surfers with ultra fast internet connections or bots trying to scrape or attack the site.

Any ideas?

Thanks

[NatalieMojoHost]

A simple test of blocking those IPs would answer your question in whether or not it is an attack. 10 or 20 doesn't sound like enough for a full-fledged DDOS but of course it all depends on the server resources. If nothing breaks and you get no complaints after null-routing those IPs - they were malicious bots. An alternative would be to use Web Application Firewall such as MojoShield or Cloudflare. The solution is made specifically for weeding out potential attacks and stopping malicious bots.

[gnawledge]

Originally Posted by mopek1

Hey,

I wanted to get your opinions on something.

I've been seeing a tiny lag in my site's loading time, usually in the morning and only for a few seconds at a time. It is intermittent, meaning 5 minutes of normal behavior and then the pages load slowly for about 20 seconds and then back to normal.

My host said the network seems fine but they have noticed that there are a handful of IPs that have multiple hundreds of connections each.

They took my server offline for a bit to check something and when it came back on the CPU usage was through the roof with those same IPs - about 10 to 20 of them - immediately connecting again with multiple hundreds of connections.

They said they don't know if those are legit surfers with ultra fast internet connections or bots trying to scrape or attack the site.

Any ideas?

Thanks

>> I am unsure if you have a firewall set up in place for that. You can always try to monitor those connections going to your server. I have to blacklist Russian and Chinese attackers constantly. You should also see if you can find someone to tune up your Apache setup, maybe? I use Stackpath CDN and Memcache for my sites that take up a lot of resources. I am not that privy on fine tuning a dedicated server--I know a little to get me going. If you have a Cpanel license, there are hot link protection too. I pay my friend who helps me with my dedicated server monthly. He is worth every penny. His main job is working for a large hosting company from the Netherlands that operates throughout the world. If you want someone to keep your server going flawlessly, message me.

[plsureking]

Originally Posted by mopek1

They said they don't know if those are legit surfers with ultra fast internet connections or bots trying to scrape or attack the site.

those are the same to me. if they are legit, then you need more resources and/or more efficient code. if they are not legit, like the 250k+ IPs i block daily, you need some scripts that can detect and block faster.

either way, efficient code and a decent server will alleviate most problems.

if you use pingdom speed test, it will give you hints as to what is slowing down the page. it might be something small that gets big with a heavy load.

https://tools.pingdom.com/

#

[sandman!]

look at who owns the ips they are probably bots and need to be blocked.