The other day; I noticed like 10 people viewing my site and since the new forum has only been up a few hours at that point, I found it suspicious. After running a whois on the IP address; I discovered that the IP is associated with the ZBot/Zeus banking Trojan.
I set up a ban for the IP range 123.125.71.*. I had no more visits from that IP range since. Well, until today when I saw 5 users on at once and went to check it out. According the Active users list, that same IP range was viewing postings.
Is the ban not working; and if not, how do I fix this issue?