When my server load spikes, I go to Joomlawatch first to see what is happening on my sites. I have noticed an odd pattern. We noticed today six or seven entries from 220.127.116.11, all at the SAME time, which technically isn't supposed to happen. More strange than that is that the attack happened about 14:15 in the afternoon. But all the bot visits STARTED at 19:00:00 (which hadn't happened yet). There were four entries in each of the bot listings for 19:00:00 and then in each of the bot entries hit the front page of the site five times.
In this particular case, there were 5 hits from the same IP, with exactly the same pattern. Tech support is at a loss to figure out what this means or why it is happening. Is the bot maybe resident on the system and activated at a certain time, programmed to hit several hours later? Or does it bypass the logging system when it hits, and somehow registers its time as 19:00:00?
I would love an answer for this!