Issue: Strange and seemingly random entries on the CPanel Latest Visitors console, showing IPs accessing image files without any referring URL and not identified as Bots.
Background: I have never had any website or IT training or instruction. I created several websites about transportation hobby subjects, which should be very calm and uneventful. The kind of stuff that might be interesting to a dozen or so people in the USA, Canada, Japanese, UK, and Australia. These websites were hosted with a web hosting company run by an absentee manager. They shut down and I transferred the domains to a new company, which turned all the controls over to me. About a month into the new service, and the largest of the websites exceeded the 5gb basic setting and had to be bumped up into the 15gb service and increased charge. I started watching the bandwidth usage climb, and figured out how to use the IP Blocker console. I have not managed to figure out HTAccess or Robots.txt, but will leave those for another time. I have managed to block most of the worth of the SEO Profiler and Chinese/Russian bots which don't follow Robots.txt rules anyway. And I have managed to block the rotating bunch of Russian/Ukranian URLs that cluster requests for one specific file a dozen times a day. But the bandwidth draw is not decreasing.
I started noticing IPs requesting image files without any Referring URL, and not identified as a Bot, but identified as a browser or a cel phone. I know this is not normal surfing, because there are no Html files being pulled to call up the image files, and the image files are in clusters that do not correlate to any group used on any of the web pages. I am running the IPs through the Whois Lookups, and coming up with a couple groupings: Soviet Block countries - Russia, Ukraine, Bulgaria, Estonia... Latin Speaking Countries - Brazil, Spain, Costa Rica... China. South Africa. All places with nothing to do with the website content as the topic matter was not available in those countries.
And there are some IPs coming up as Canada, Washington State, New Jersey, etc., but I am hesitant to block those.
What am I looking at here? Is there some kind of money making deal of aiming remote and overseas IPs at my websites and hitting a couple pictures in rapid succession a dozen times a day from 100+ different addresses?