I'm seeing some obvious bot/script traffic that is bloating our Google Analytics(GA) data. I figure the traffic is using something that loads JS, CSS, etc. which is why it's affecting GA.
So I put in a process to detect and ban this traffic. Our GA data has returned to normal however when I analyze the banned traffic there are situations where I cannot tell if it was a false positive or not.
The key to my process is that the URL has an email address in the querystring. I was seeing the same email address making multiple requests per second using different IPs. That one is easy. However I'm also seeing requests that appear at a human request rate but are still using multiple IPs.
Another important part of this is that these requests are coming from cloud providers like Google and Amazon. I'm also seeing a fair amount coming from Cogent Communications which I was not familiar with. Also we only get about 8k sessions per day so we aren't talking about a lot of legit requests per second. So it's easy to spot the upticks.
Getting back to the potential false positives. I figure that if I see the same "visitor" using 3+ IPs then it's not legit. I account for a visitor starting on their phone and switching to their computer. However what is in the back of my mind is how anonymous browsing, VPNs and proxies work.
So my question is are there legit situations where a customer will use 3+ IPs in a 5-10 minute session? There will be edge cases but I'm more concerned about common situations that I'm not aware of.
