I'm seeing some obvious bot/script traffic that is bloating our Google Analytics(GA) data. I figure the traffic is using something that loads JS, CSS, etc. which is why it's affecting GA.

So I put in a process to detect and ban this traffic. Our GA data has returned to normal however when I analyze the banned traffic there are situations where I cannot tell if it was a false positive or not.

The key to my process is that the URL has an email address in the querystring. I was seeing the same email address making multiple requests per second using different IPs. That one is easy. However I'm also seeing requests that appear at a human request rate but are still using multiple IPs.

Another important part of this is that these requests are coming from cloud providers like Google and Amazon. I'm also seeing a fair amount coming from Cogent Communications which I was not familiar with. Also we only get about 8k sessions per day so we aren't talking about a lot of legit requests per second. So it's easy to spot the upticks.

Getting back to the potential false positives. I figure that if I see the same "visitor" using 3+ IPs then it's not legit. I account for a visitor starting on their phone and switching to their computer. However what is in the back of my mind is how anonymous browsing, VPNs and proxies work.

So my question is are there legit situations where a customer will use 3+ IPs in a 5-10 minute session? There will be edge cases but I'm more concerned about common situations that I'm not aware of.

1 Answer 1


So my question is are there legit situations where a customer will use 3+ IPs in a 5-10 minute session?


A client of a big ISP can use the ISP HTTP proxy (voluntarily or not), which can be so big has to have multiple outside IP addresses, hence each request can be seen on a website to come from a different IP address.

You could however also match on other parts of the content, like some headers from the client (user-agent, accept, etc.) which are a fingerprint.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.