Increase in visits through anonymous proxies

Forum Moderators: phranque

Message Too Old, No Replies

Increase in visits through anonymous proxies

aristotle

1:39 am on Feb 26, 2014 (gmt 0)

During the past couple of days one of my sites has had a significant increase in a category of traffic which Statcounter reports as anonymous proxies. I noticed it because this is a small new site that only gets about 50 visitors a day, so that I can watch them individually. So far today there have been 8 visits through these anonymous proxies. The IP addresses are all in Europe, and all different, although the site is hosted in the U.S. Does anyone have any thoughts about what could cause this?

brotherhood of LAN

1:44 am on Feb 26, 2014 (gmt 0)

Are they crawling the site, i.e. scraping or just hitting the same pages? Primary two reasons are scraping and mimicking user behaviour IMO. Saying that they could also be looking for vulnerabilities depending on the URLs they're trying to fetch.

cmendla

4:08 am on Feb 26, 2014 (gmt 0)

Do a site:yoursite.com in google and see if any strange results are there, particularly pharma pages.

aristotle

11:22 am on Feb 26, 2014 (gmt 0)

Thanks for the suggestions

brotherhood of LAN -- After looking at this some more, I've decided that these are probably crawlers, but an unusual type that downloads images and executes the Statcounter code. They go to the home page, but nowhere else, and don't click any links.

cmendla -- The site: search doesn't show anything that shouldn't be there, but it might be too soon for something to show up. There's no sign of any problems in the cPanel files directories

I'll just have to keep watching. It's been almost 12 hours now since the last one came by, so maybe they've finished whatever they've been doing. All the pages on this site are static html except for the Statcounter code, so I don't think they'll find any obvious vulnerabilities.

cmendla

2:51 pm on Feb 26, 2014 (gmt 0)

One of the extensions I use for Joomla allows geo blocking. We had one particular site where it was definitely a brick and mortar business that had no use for overseas visits. We geoblocked everything but the US.

I noticed in the logs that there were a lot of hits from china etc trying to hit a small database we had. The extension blocked them.

IOW, if you do not need overseas traffic, consider geoblocking them

aristotle

7:03 pm on Feb 26, 2014 (gmt 0)

Thanks cmendla -- I'm already blocking a few countries, using the following .htaccess code:

RewriteCond %{HTTP_REFERER} \.(ru|ua|cn|pl|ro)(/|$) [NC]
RewriteRule .* - [F]
ErrorDocument 403 "Access Denied"

I got this code from another Webmaster World thread a few years and have been using it on most of my sites since then. I probably should add some more countries to block. For your case I think you might be talking about a different approach that blocks everything except the U.S.