Suspicious visitors - Webmaster General forum at WebmasterWorld - WebmasterWorld

Forum Moderators: phranque

Suspicious visitors

Suspicious visitors

Wmff

9:08 pm on Jul 14, 2026 (gmt 0)

Top Contributors Of The Month

Am I being paranoid? I have been getting large numbers of visits that all "seem" to have something in common. They all visit the same page or 1 of the same 2 pages. They all have the same user agent data, most have no referrer but occasionally a large number in a short time frame will all report Google.
The data in the tracking service screen shots matches up with the data in my server logs:

tracking service data:
(1) Initial Referrer: (No referring link)
ISP: Frontier CommunicationsPlatform / Resolution: Desktop / 1920x1080
IP Address: 47.201.98.xx — OS: Linux
Location: [United States] Zephyrhills, Florida, United StatesBrowser: Chrome 149.0

server log:
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36

tracking service data:
(2) Initial Referrer: (No referring link)
ISP: T-mobile UsaPlatform / Resolution: Desktop / 1920x1080
IP Address: 172.59.196.xx— OS: Linux
Location: [United States] Garland, Texas, United StatesBrowser: Chrome 149.0

server log:
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
[server reported this IP - 2607:fb91:4612:e5ab:be5c:17ff:fe0e:f9ce]

To me this does not look like a normal human visitor but may either be malicious bot/botnet or someone using a VPN or proxy server.
What's your opinion?

[edited by: not2easy at 10:05 pm (utc) on Jul 14, 2026]
[edit reason] anonymized IP [/edit]

not2easy

10:16 pm on Jul 14, 2026 (gmt 0)

WebmasterWorld Administrator

10+ Year Member

Top Contributors Of The Month

Sorry for the edits, but we anonymize IPs reported - but that is in the Spiders and UAs forum: [webmasterworld.com...] so you probably wouldn't know that. The IPs appear to be residential IPs but those are sometimes compromised devices. It is not unusual for ISPs to shuffle IPs, at any rate, so behavior is more decisive than IPs.

Apple devices may indicate the IP as IPv6 as you show here (2607:fb91:4612:e5ab:be5c:17ff:fe0e:f9ce)

PS. the forum's software uses square brackets so it made the text tiny and were changed to parentheses.

lucy24

4:15 pm on Jul 15, 2026 (gmt 0)

WebmasterWorld Senior Member

10+ Year Member

Top Contributors Of The Month

This has been going on for months--to the point where I no longer bother to block IPs, because they're invariably compromised (voluntarily or otherwise) human IPs and you can't clog up your htaccess with /32s. To this day, I have not been able to figure out why botrunners need ten or twenty copies of the same html page (with no supporting files). Or, for that matter, why they even need one. What do they do with the ### things?

Apple devices may indicate the IP as IPv6

I don't think it's the device as such. It depends on whether the site itself has a fixed IPv6 address. Two of mine do, and in those, some requests will come through in logs as IPv6.

Wmff

5:24 pm on Jul 15, 2026 (gmt 0)

Top Contributors Of The Month

From what I read in these 2 responses seems to confirm what I suspected and was suggested by the fact that my tracking service reports an IP, that I have banned, but my server logs for that same time will show a completely different IP that is not banned, ergo a "botrunner" has stored copies of my pages and the VPS/proxy servers are hitting those stored pages and triggering the tracking script.

Therefore, a person using a VPS/proxy service fails to access my page so they pop out from behind the proxy and open my page with their own IP address. Of course, as suggested, even what looks like a legitimate visit may just be compromised or faking credentials especially when they all have the same credentials.

I do seem to have successfully blocked most VPS servers but that only seems to have trigger the wave of "suspicious" visits that I described. I guess the AI bots learn too quickly. Either that or people are abandoning the proxy and visiting directly - or is that naively optimistic?

lucy24

7:56 pm on Jul 15, 2026 (gmt 0)

WebmasterWorld Senior Member

10+ Year Member

Top Contributors Of The Month

If it's a bona fide human visiting, you should be seeing the full set of supporting files--unless the same human on the same browser (not necessarily the same IP) visited fairly recently, in which case the supporting files will probably be cached. If you use analytics of any kind, most-though-not-all humans will send a cookie set on their previous visit.

Wmff

9:10 pm on Jul 15, 2026 (gmt 0)

Top Contributors Of The Month

That is what I have noticed. What I suspected to be bots only hit an image or in the case of VPS/proxy servers, they only open a part of the template or other other "pieces" of the page. Whereas was looked to be an actual human visitor will open all, or most, of the page elements. Another sign of a human visitor seems to be that they also open the favicon.ico. Thanks for the replies :-)

PeterTroyWilliams

6:00 pm on Jul 17, 2026 (gmt 0)

I had the same issue with Occulus Networks. Same user agent and Screen res as your issue. I fixed it by adding this to my .hyaccess file (apache) #BEGIN Blacklist
<RequireAll>
Require all granted
Require not ip 40.223.0.0/16
Require not ip 172.121.0.0/16
Require not ip 172.252.0.0/16
</RequireAll>
# END Blacklist

These were the ip ranges it was coming from,Replace with your own offending ips if you are trying this..

RedBar

4:51 pm on Jul 19, 2026 (gmt 0)

WebmasterWorld Senior Member

10+ Year Member

Top Contributors Of The Month

Apart from the pathetic MSFT brute force php attempts I occasionally get something, I assume, trying a DDOS attack. It's always the same page 500-600 times early morning UK time and is tried on two consecutive days. The same machine bounces from one IP to another in very quick succession and then its gone.

It's easily identifiable in my raw logs plus one of my sites had such a visitor this morning therefore I assume again tomorrow.