We have an Indian ecommerce website, where around 85% traffic comes from India only. I was observing access logs of last 2 months and found out that nearly 50% traffic is coming from a single IP (18.104.22.168) and it doesn't seems to be fake. Because there is a wide range of User agent string which is being used and also our repeat customer's (who has placed order before) are also coming through this IP now.
On checking this IP details, it belongs to - United States - NY - Rochester - Rochester General Hospital. And customer's who are placing order through this IP are from India only.
However, Google analytics doesn't show any discrepancy. I mean it still shows around 85% traffic from India. But based on this IP location, it should also show more than 50% traffic from USA
Website is hosted on AWS EC2, behind a ELB. And I don't believe it is IP of AWS, because rest 50% traffic has mixed IPs.
My Questions is:
- What could be the possible reason of this change?
- Is this IP masked? I mean, is it possible to find out actual IP behind this?
Tracking IPs is part of our job to figure out fake paid traffic to block it. But due to this, it's becoming impossible to block it.