Timeline for Suspicious Web Traffic from Amazon.com ISP
Current License: CC BY-SA 3.0
22 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Mar 12 at 12:45 | history | protected | CommunityBot | ||
| Mar 11 at 22:15 | comment | converted from answer | INSITE GURU | I am seeing the same kind of traffic and I know for sure that it is attempting breach. They used a few other methods to look for ways to start a session or clear my cgi in an attempt to download shell script on a website and subdomains that are not publicized and brand new. | |
| Jul 7, 2020 at 18:12 | comment | added | Super potateo | I found the same thing on my domain stats but after doing some looking I found out Amazon sells an ISP with frontier. (please note I am a noob) | |
| Nov 28, 2018 at 1:00 | answer | added | kwaka | timeline score: 2 | |
| Mar 11, 2017 at 9:00 | history | tweeted | twitter.com/StackWebmasters/status/840487469518901249 | ||
| Mar 9, 2017 at 22:26 | answer | added | Justin | timeline score: 2 | |
| Dec 6, 2016 at 12:47 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
| Nov 6, 2016 at 12:20 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
| Oct 7, 2016 at 11:10 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
| Sep 7, 2016 at 10:10 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
| Aug 8, 2016 at 9:38 | history | edited | Josip Ivic | CC BY-SA 3.0 |
added 4 characters in body
|
| Aug 8, 2016 at 9:22 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
| Jul 7, 2016 at 1:31 | answer | added | Chris Rutherfurd | timeline score: 2 | |
| Nov 28, 2015 at 15:52 | comment | added | closetnoc | Be careful using the term ISP. It is a bit fuzzy. I do recommend blocking host IP address blocks routinely but not necessarily subscriber lines which are your user based access channels such as broadband. | |
| Nov 28, 2015 at 10:39 | comment | added | Ramnath | @closetnoc That's a matter of serious concern and I guess many webmasters are facing similar problems. Do you feel blocking the ISP addresses the issue? | |
| Nov 27, 2015 at 15:50 | comment | added | closetnoc | That is just a part of it. Archive.org is part of Amazon. Between archive.org and the bad activity on Amazon, the bulk of all content scraping and copyright infringements happen. They are not the only ones. For a while, a Google apps IP address was scraping too. But that has ended. The final straw was that no matter what, archive.org was scraping my site and ignored robots.txt for years. Since the beginning, I have tried to block them and they still posted my content on their site which is a copyright infringement. For a long while, my content on their site out performed in search. | |
| Nov 27, 2015 at 13:58 | comment | added | the_velour_fog | @closetnoc so is the reason you block archive.org and amazon - because they effectively turn a blind eye to the activity of their customers on their network? | |
| Nov 27, 2015 at 3:07 | comment | added | closetnoc | @nyuen is making a valid point. It would be far better for us to see the log entries themselves in order to tell you what they are really up to. Please know that Amazon as an ISP is very permissive and is #2 in my abuse database the last time I did an audit which has been a while ago. There are many who use Amazon to scrape and abuse websites. Keep in mind short of an employee, this is not likely a user. It is likely a machine and therefore safe to block. I only blacklist two networks, archive.org and amazon. | |
| Nov 27, 2015 at 2:58 | comment | added | nyuen | What are the landing pages? In most cases, if it's bot activity, the landing pages may all be the same. Also check bounce rates. | |
| Nov 27, 2015 at 1:42 | comment | added | Ramnath | Can you pls elaborate a bit? Landing pages vary with session although 8-10% are similar. Source/medium is Direct or not set. I suspect foul play mainly because there's too many sessions with same browser/OS/resolution and similar IP. | |
| Nov 27, 2015 at 1:36 | comment | added | nyuen | Ashburn is home to many data centres, and there are a few things you can check to try to determine the nature of the traffic: source/medium, landing page, network domain... you'll need to try and find a pattern here, but unfortunately, it may be something that you won't be able to avoid, as the traffic could be legitimate. | |
| Nov 27, 2015 at 0:27 | history | asked | Ramnath | CC BY-SA 3.0 |