Can anyone tell me what's going on with two sets of strange web site visitors?

Question

Our web site is plagued by mysterious 'visitors' who consistently get no further than the home page. All of these 'visitors' have IP addresses beginning with 138.197 via Digital Ocean. The remaining IP numerals vary, all of the 'visitors' are shown as coming from Wilmington, Delaware, with no referrer. The browsers and operating systems vary. IP addresses for the past month or so are:

138.197.11.136
138.197.111.36
138.197.111.102
138.197.111.122
138.197.111.50
138.197.6.74
138.197.111.84
138.197.71.243
138.197.96.249
138.197.111.31

Many of these make multiple 'visits' in a day or a given week. I'd be happy to make whoever is behind these pseudo visits stop

I am unaware of any 'cult' following, least of all in Wilmington, DE. I am aware that the FBI has a branch there. Is there any way to know whether this is some bizarre government snooping? There's absolutely nothing of interest to them on the site, least of all on the home page, so I cannot guess why they would be bothering themselves so often making pointless visits using different computers.

Let me add in at this point that my site has been repeatedly scanned for malware or blacklisting and none has ever been found. Scans for malware and blacklisting are run daily. Consequently, my web site has absolutely nothing to do with whatever or whomever is making these bizarre visits. Likewise, my PC is running Kaspersky, has been for years, and is likewise scanned daily.

And to add to the mystery, just recently there have been a number of visits where little information is recorded about the visitor. My stats show a question mark for nearly every field with the exception of the IP address and place of origin. All of these newer visits are from Houston, Texas USA and begin with 34...* but the subsequent numerals are always different. Here is a list of those IP's:

34.250.99.222
34.252.124.230
34.240.95.112
34.240.26.189
34.250.6.11
34.253.0.71

Neither of these mysterious visitors' visits are so numerous to be any kind of DOS attack, so I can't guess what they are about.

Anyone know what's going on with these two phenomena?

Thanks.

Answer 1

Probably just some crawlers, bots, nothing to worry about it. Just make sure that your website is secure and there is no data leaking.

From my experience I saw that many website owners are just careless about their data, so it is easy to find sensitive data on their website.

Especially take a good look if some of these kind of files are publicly available:

*.sql, *.log, *.bak, *.old etc.

Just run:

find . -type f -name "*.sql"

Than check on Google:

site:yourwebsite.com ext:sql

Use Google Alerts, it will alert you if any of your sensitive data appear in Google searches.

Answer 2

I would take action to block these dynamically using Fail2Ban (https://www.fail2ban.org/wiki/index.php/Main_Page).

These are not only potentially malicious, they are sucking up your bandwidth. The fact they have no referrer will make them easy to filter and block.

A decent filter strategy would be to check referrer, user agent, request type, request frequency and IP address. Combine these to create something the will temporarily block/drop the requests form the IPs bombarding your server.