4

I am hosting my website on a Digital Ocean droplet. It's very new and I'm not expecting any activity yet. However looking at the Analytics I started to notice a high daily increase from a particular source: digital ocean inc.

digital ocean inc. Google Analytics

And when filtering by "Service Provider" it becomes apparent:

digital ocean inc. Service Provider

I have attempted to add a filter, however "Service Provider" is not an option to choose. I cannot filter by IP Address, because looking at my Webserver Access Log, it changes. However it always makes these 4 same GET requests:

Web server Access Log

How do I get around filtering this spam traffic? What does this bot achieve by performing these simple requests?

Improve this question
4
  • 3
    This is not spam. Call your host to find out what this is. It is likely a monitor process that ensures your site is available.
    – closetnoc
    Nov 20, 2016 at 1:09
  • @closetnoc It's unlikely a process monitoring service since it would not make specific GET requests to the mentioned files. I have created a support ticket with Digital Ocean. Will post update.
    – Qerim
    Nov 20, 2016 at 1:51
  • 1
    Yeah it would. I used to be a web host and one of my monitors, the external monitor, made standard HTTP requests just like a browser. These would fetch all resources within a page just like a user. I used to filter these in my Sawmill reports. My other monitors were against services and other things in a heads-up display that was monitored 24 hours a day by personnel in the NOC. However, like I said, I had another network purely to monitor sites including changes such as hacking, spam, etc. as well as whether a site was available via the Internet. Cheers!!
    – closetnoc
    Nov 20, 2016 at 4:17
  • @closetnoc you are right. See DO's response below. Sorry. Thanks for your input :)
    – Qerim
    Nov 20, 2016 at 10:12

1 Answer 1

Reset to default
3

@closetnoc was right.

I have contacted Digital Ocean and they responded with:

It looks like these IPs are related to a monitoring service, are you currently subscribed to one? If not, it's entirely possible the person who had this IP address before you was the one subscribed, and simply hasn't updated their information.

If it's not your monitoring, it's nothing to worry about and will likely stop in the near future. If it is yours, then you know they're doing their job!

I was wrong with saying "4 same GET requests", as this is obviously just a single request to the landing page and the other resources are loaded in by default.

So for now I will manually block those IP's (7 so far) in Google Analytics.

Improve this answer
1
  • 1
    I am glad you got your answer and I very much appreciate you sharing the answer here! Cheers!!
    – closetnoc
    Nov 20, 2016 at 17:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.