0

Our web site is plagued by mysterious 'visitors' who consistently get no further than the home page. All of these 'visitors' have IP addresses beginning with 138.197 via Digital Ocean. The remaining IP numerals vary, all of the 'visitors' are shown as coming from Wilmington, Delaware, with no referrer. The browsers and operating systems vary. IP addresses for the past month or so are:

138.197.11.136
138.197.111.36
138.197.111.102
138.197.111.122
138.197.111.50
138.197.6.74
138.197.111.84
138.197.71.243
138.197.96.249
138.197.111.31

Many of these make multiple 'visits' in a day or a given week. I'd be happy to make whoever is behind these pseudo visits stop

I am unaware of any 'cult' following, least of all in Wilmington, DE. I am aware that the FBI has a branch there. Is there any way to know whether this is some bizarre government snooping? There's absolutely nothing of interest to them on the site, least of all on the home page, so I cannot guess why they would be bothering themselves so often making pointless visits using different computers.

Let me add in at this point that my site has been repeatedly scanned for malware or blacklisting and none has ever been found. Scans for malware and blacklisting are run daily. Consequently, my web site has absolutely nothing to do with whatever or whomever is making these bizarre visits. Likewise, my PC is running Kaspersky, has been for years, and is likewise scanned daily.

And to add to the mystery, just recently there have been a number of visits where little information is recorded about the visitor. My stats show a question mark for nearly every field with the exception of the IP address and place of origin. All of these newer visits are from Houston, Texas USA and begin with 34...* but the subsequent numerals are always different. Here is a list of those IP's:

34.250.99.222
34.252.124.230
34.240.95.112
34.240.26.189
34.250.6.11
34.253.0.71

Neither of these mysterious visitors' visits are so numerous to be any kind of DOS attack, so I can't guess what they are about.

Anyone know what's going on with these two phenomena?

Thanks.

  • Try to fetch some entire http request from the source IP Stated above with your favorite packet capture soft. Please edit your question, HTTP Headers and data will help me providing you an acceptable answer. My guess is those IP are probably some crawlers. – Baptiste Sep 13 '17 at 5:34
  • Sorry, I'm not so tech savvy as to know what you're talking about. Thanks anyway. – user6318597 Sep 14 '17 at 12:31
6

Probably just some crawlers, bots, nothing to worry about it. Just make sure that your website is secure and there is no data leaking.

From my experience I saw that many website owners are just careless about their data, so it is easy to find sensitive data on their website.

Especially take a good look if some of these kind of files are publicly available:

*.sql, *.log, *.bak, *.old etc.

Just run:

find . -type f -name "*.sql"

Than check on Google:

site:yourwebsite.com ext:sql

Use Google Alerts, it will alert you if any of your sensitive data appear in Google searches.

  • Bots and crawlers are defiantly worth worrying about. Many are malicious and are a pre cursor for future attacks. The best strategy is to monitor them and take action against those that are overly aggressive, don't honour the robots.txt or otherwise act suspicious. – Trickycm Sep 13 '17 at 9:21
  • I tried those searches, thanks, nothing came up. Actually, there is no 'sensitive' data for anyone to take an interest in, which is why I am so mystified by these visits. – user6318597 Sep 14 '17 at 12:32
0

I would take action to block these dynamically using Fail2Ban (https://www.fail2ban.org/wiki/index.php/Main_Page).

These are not only potentially malicious, they are sucking up your bandwidth. The fact they have no referrer will make them easy to filter and block.

A decent filter strategy would be to check referrer, user agent, request type, request frequency and IP address. Combine these to create something the will temporarily block/drop the requests form the IPs bombarding your server.

  • Thank you all for your great help. With a little help from my service provider, I've upgraded .htaccess and installed new anti-hackware! I guess now it's just wait & see… – user6318597 Sep 13 '17 at 11:09
  • Thanks. I just got an anti-hacker plugin installed (jHackGuard) as well as updating the .htaccess via code at siteground.com/kb/prevent-malicious-bots-visiting-website So far, no more of either visitor. – user6318597 Sep 14 '17 at 12:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.