Hosting Question - GoFuckYourself.com

mopek1 · 08-28-2020, 05:46 AM

Hey,

I wanted to get your opinions on something.

I've been seeing a tiny lag in my site's loading time, usually in the morning and only for a few seconds at a time. It is intermittent, meaning 5 minutes of normal behavior and then the pages load slowly for about 20 seconds and then back to normal.

My host said the network seems fine but they have noticed that there are a handful of IPs that have multiple hundreds of connections each.

They took my server offline for a bit to check something and when it came back on the CPU usage was through the roof with those same IPs - about 10 to 20 of them - immediately connecting again with multiple hundreds of connections.

They said they don't know if those are legit surfers with ultra fast internet connections or bots trying to scrape or attack the site.

Any ideas?

Thanks

NatalieMojoHost · 08-28-2020, 06:14 AM

A simple test of blocking those IPs would answer your question in whether or not it is an attack. 10 or 20 doesn't sound like enough for a full-fledged DDOS but of course it all depends on the server resources. If nothing breaks and you get no complaints after null-routing those IPs - they were malicious bots. An alternative would be to use Web Application Firewall such as MojoShield or Cloudflare. The solution is made specifically for weeding out potential attacks and stopping malicious bots.

gnawledge · 08-28-2020, 06:21 AM

Quote:

Originally Posted by mopek1

Hey,

I wanted to get your opinions on something.

I've been seeing a tiny lag in my site's loading time, usually in the morning and only for a few seconds at a time. It is intermittent, meaning 5 minutes of normal behavior and then the pages load slowly for about 20 seconds and then back to normal.

My host said the network seems fine but they have noticed that there are a handful of IPs that have multiple hundreds of connections each.

They took my server offline for a bit to check something and when it came back on the CPU usage was through the roof with those same IPs - about 10 to 20 of them - immediately connecting again with multiple hundreds of connections.

They said they don't know if those are legit surfers with ultra fast internet connections or bots trying to scrape or attack the site.

Any ideas?

Thanks

>> I am unsure if you have a firewall set up in place for that. You can always try to monitor those connections going to your server. I have to blacklist Russian and Chinese attackers constantly. You should also see if you can find someone to tune up your Apache setup, maybe? I use Stackpath CDN and Memcache for my sites that take up a lot of resources. I am not that privy on fine tuning a dedicated server--I know a little to get me going. If you have a Cpanel license, there are hot link protection too. I pay my friend who helps me with my dedicated server monthly. He is worth every penny. His main job is working for a large hosting company from the Netherlands that operates throughout the world. If you want someone to keep your server going flawlessly, message me.

plsureking · 08-28-2020, 06:57 AM

Quote:

Originally Posted by mopek1

They said they don't know if those are legit surfers with ultra fast internet connections or bots trying to scrape or attack the site.

those are the same to me. if they are legit, then you need more resources and/or more efficient code. if they are not legit, like the 250k+ IPs i block daily, you need some scripts that can detect and block faster.

either way, efficient code and a decent server will alleviate most problems.

if you use pingdom speed test, it will give you hints as to what is slowing down the page. it might be something small that gets big with a heavy load.

https://tools.pingdom.com/

#

sandman! · 08-28-2020, 07:30 AM

look at who owns the ips they are probably bots and need to be blocked.

08-28-2020, 05:46 AM	#1
mopek1 Confirmed User Industry Role: Join Date: Jun 2004 Location: Canada Posts: 3,056	Hosting Question Hey, I wanted to get your opinions on something. I've been seeing a tiny lag in my site's loading time, usually in the morning and only for a few seconds at a time. It is intermittent, meaning 5 minutes of normal behavior and then the pages load slowly for about 20 seconds and then back to normal. My host said the network seems fine but they have noticed that there are a handful of IPs that have multiple hundreds of connections each. They took my server offline for a bit to check something and when it came back on the CPU usage was through the roof with those same IPs - about 10 to 20 of them - immediately connecting again with multiple hundreds of connections. They said they don't know if those are legit surfers with ultra fast internet connections or bots trying to scrape or attack the site. Any ideas? Thanks

08-28-2020, 06:14 AM	#2
NatalieMojoHost Confirmed User Industry Role: Join Date: Aug 2013 Posts: 1,470	A simple test of blocking those IPs would answer your question in whether or not it is an attack. 10 or 20 doesn't sound like enough for a full-fledged DDOS but of course it all depends on the server resources. If nothing breaks and you get no complaints after null-routing those IPs - they were malicious bots. An alternative would be to use Web Application Firewall such as MojoShield or Cloudflare. The solution is made specifically for weeding out potential attacks and stopping malicious bots. __________________ MojoHost.COM \| natalie at mojohost dot com \| Skype natalie.ac \| Telegram @znatalie. Since 1999: 70 Adult Industry awards for Best Hosting Company and professional excellence.

08-28-2020, 07:30 AM	#5
sandman! Icq: 14420613 Industry Role: Join Date: Mar 2001 Location: chicago Posts: 15,432	look at who owns the ips they are probably bots and need to be blocked. __________________ Need WebHosting ? Email me for some great deals [email protected]