# Random contacts being added to my Mautic, but I can't find traces of those contacts. Am I being hacked?

**URL:** <https://forum.mautic.org/t/random-contacts-being-added-to-my-mautic-but-i-cant-find-traces-of-those-contacts-am-i-being-hacked/20657>\
**Category:** Product Support\
**Tags:** mautic-3\
**Created:** [August 31, 2021, 10:54am UTC](https://forum.mautic.org/t/random-contacts-being-added-to-my-mautic-but-i-cant-find-traces-of-those-contacts-am-i-being-hacked/20657 "2021-08-31T10:54:40Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

**Author:** ![EJL](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/ejl/32/12155_2.png) [@EJL](https://forum.mautic.org/u/EJL)\
**Post date:** [September 1, 2021, 4:42pm UTC](https://forum.mautic.org/t/random-contacts-being-added-to-my-mautic-but-i-cant-find-traces-of-those-contacts-am-i-being-hacked/20657/5 "2021-09-01T16:42:08Z")

</div>

> [@joeyk](#):
>
> I found, that some hackers try to fish around and hope, that a system admin left a backup somewhere laying around in a public folder.

This is exactly right. Scripts are used to scan directories on servers looking for common vulnerabilities, or access to files that can be edited to give escalated privileges. The script gets a 404 error if its web based or access denied if its otherwise. Keeping your server up to date and using something like Fail2ban is an easy way to secure. Here is a snap of my Fail2Ban log with 4500+ blocked IP address for exactly this issue.

 ![Screenshot (3)](https://us1.discourse-cdn.com/flex020/uploads/mautic/original/2X/d/d3f9ecd829470d918fe0279648d1a60e04caacc0.png)

We briefly discussed this here as well:

> [@Don't create anonymous contacts on Mautic system pages](https://forum.mautic.org/t/dont-create-anonymous-contacts-on-mautic-system-pages/18959/10):
>
> 50%-60% of all internet traffic is bots/spiders. Add this to your .htaccess file if you want to block the bad ones 1. RewriteEngine on 2. # Abuse Agent Blocking 3. RewriteCond %{HTTP\_USER\_AGENT} ^[Ww]eb[Bb]andit [NC,OR] 4. RewriteCond %{HTTP\_USER\_AGENT} ^$ [NC,OR] 5. RewriteCond %{HTTP\_USER\_AGENT} ^Acunetix [NC,OR] 6. RewriteCond %{HTTP\_USER\_AGENT} ^binlar [NC,OR] 7. RewriteCond %{HTTP\_USER\_AGENT} ^BlackWidow [NC,OR] 8. RewriteCond %{HTTP\_USER\_AGENT} ^Bolt\ 0 [NC,OR] 9. RewriteCond %{H…

---

_[View the full topic](https://forum.mautic.org/t/random-contacts-being-added-to-my-mautic-but-i-cant-find-traces-of-those-contacts-am-i-being-hacked/20657)._