4

I am hosting my website on a Digital Ocean droplet. It's very new and I'm not expecting any activity yet. However looking at the Analytics I started to notice a high daily increase from a particular source: digital ocean inc.

digital ocean inc. Google Analytics

And when filtering by "Service Provider" it becomes apparent:

digital ocean inc. Service Provider

I have attempted to add a filter, however "Service Provider" is not an option to choose. I cannot filter by IP Address, because looking at my Webserver Access Log, it changes. However it always makes these 4 same GET requests:

Web server Access Log

How do I get around filtering this spam traffic? What does this bot achieve by performing these simple requests?

  • 3
    This is not spam. Call your host to find out what this is. It is likely a monitor process that ensures your site is available. – closetnoc Nov 20 '16 at 1:09
  • @closetnoc It's unlikely a process monitoring service since it would not make specific GET requests to the mentioned files. I have created a support ticket with Digital Ocean. Will post update. – Qerim Nov 20 '16 at 1:51
  • 1
    Yeah it would. I used to be a web host and one of my monitors, the external monitor, made standard HTTP requests just like a browser. These would fetch all resources within a page just like a user. I used to filter these in my Sawmill reports. My other monitors were against services and other things in a heads-up display that was monitored 24 hours a day by personnel in the NOC. However, like I said, I had another network purely to monitor sites including changes such as hacking, spam, etc. as well as whether a site was available via the Internet. Cheers!! – closetnoc Nov 20 '16 at 4:17
  • @closetnoc you are right. See DO's response below. Sorry. Thanks for your input :) – Qerim Nov 20 '16 at 10:12
3

@closetnoc was right.

I have contacted Digital Ocean and they responded with:

It looks like these IPs are related to a monitoring service, are you currently subscribed to one? If not, it's entirely possible the person who had this IP address before you was the one subscribed, and simply hasn't updated their information.

If it's not your monitoring, it's nothing to worry about and will likely stop in the near future. If it is yours, then you know they're doing their job!

I was wrong with saying "4 same GET requests", as this is obviously just a single request to the landing page and the other resources are loaded in by default.

So for now I will manually block those IP's (7 so far) in Google Analytics.

  • 1
    I am glad you got your answer and I very much appreciate you sharing the answer here! Cheers!! – closetnoc Nov 20 '16 at 17:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.