[Forum] Spam attack?

[Vintum]

Hello, I have recently started my forum and just about an hour ago it appeared to have come under attack. I had a few different IP ranges that were all opening multiple sessions and each one appearing as a separate "guest". I banned these IP ranges, and the flooding seems to be stopping for now.

But now my question is what could this actually have been? And how can I prevent this?

During this "attack" my website was going quite slow, but still functional. I turned off access for a few minutes while I installed a spambot plugin and turned it back on.

I have attached a screenshot of my "who's online" in case someone wanted to see it.

[Zachery]

I don't even see that many ip's listed, a simple whois: http://whois.domaintools.com/5.248.81.95

Each ip is a unique person, as far as vbulletin is concerned, and even then they can be more unique (cookied user, different session).

It could be any number of things.

[Vintum]

Yes, They are all the same few IPs. I have banned them a few hours ago, and yet they are still actually continuing to try and access my website. I have been holding steady at about 40 guest users for the past few hours. Normally I'm only at about 2 - 5.

I just don't understand what could be going on here. It all started with a few spam threads, and as soon as I deleted those, I started getting flooded. These are all the same IPs as the spam thread creator, so I can only assume they are all spam bots.

[dizzynation]

Vintum, I highly recommend go to -- AdminCP --> Settings ---> Human Verification

and adding some "Question/Answers"

[Vintum]

Yes, I had already done that when I first started up. I was online when the first few spam accounts were being created, and I noticed them popping up but not making any posts. There were 4 total. I thought it was odd so I went in to check the IPs and emails, and found them to all be related so I started to ban them. I went back out to the forum to find several new spam threads from two of the users - the ones I banned last. So they all started trying to post at the same time after having the 4 accounts registered.
Human started the setup maybe? Since then, the same IPs have continued to try and access for the past few hours, but no new accounts.