: Am I being hacked or harvested? I just did some log analysis of Q1 for one of my client's sites. There were about 30,000 sessions created for this site for each of the five separate IP addresses
I just did some log analysis of Q1 for one of my client's sites.
There were about 30,000 sessions created for this site for each of the five separate IP addresses starting with 79.171.81.xxx. 150,000 sessions in three months on this site represents about 30% of the total traffic.
The visits are representing themselves with a consistent User-Agent string of Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Does this IP range belong to a known (beneficial) spider of some kind? Or is it more likely to be something malicious? I could take many steps including:
ignore the volume and let it access the site as much as it likes
turn off logging for this IP range
completely block it from accessing the site
anything else!
email the abuse@ address listed for the IP address and ask for clarification (or is this just asking for trouble?)
Googling for the IP addresses just gives me lots of IP lookup results.
So, I submit myself to the wider knowledge and wisdom of the crowd: what's going on here and what should I do about it (if anything)?
More posts by @Hamaas447
2 Comments
Sorted by latest first Latest Oldest Best
First, inform your client and ask what they would like to do - it's
still their site - and it could be a major customer's traffic or another source you're not privvy to.
If client knows nothing of the traffic source, suggest blocking the IP range & monitor load. Notify the client as soon as the block has been implemented.
If the traffic jumps to another IP, you know something's up.
If your client's sales team gets a phone call from irate customer(s), then you also know the source and you can now prioritize that traffic.
Any properly run robot would have information in the User-Agent that identifies who is running it.
That is not to say that this is necessarily being run for less than legit reasons, but the absence of identifying information in the User-Agent string certainly doesn't speak well for their etiquette. I'd block them for that alone.
Terms of Use Create Support ticket Your support tickets Stock Market News! © vmapp.org2024 All Rights reserved.