5

We have an Indian ecommerce website, where around 85% traffic comes from India only. I was observing access logs of last 2 months and found out that nearly 50% traffic is coming from a single IP (162.30.18.58) and it doesn't seems to be fake. Because there is a wide range of User agent string which is being used and also our repeat customer's (who has placed order before) are also coming through this IP now.

On checking this IP details, it belongs to - United States - NY - Rochester - Rochester General Hospital. And customer's who are placing order through this IP are from India only.

However, Google analytics doesn't show any discrepancy. I mean it still shows around 85% traffic from India. But based on this IP location, it should also show more than 50% traffic from USA

Website is hosted on AWS EC2, behind a ELB. And I don't believe it is IP of AWS, because rest 50% traffic has mixed IPs.

My Questions is:

  1. What could be the possible reason of this change?
  2. Is this IP masked? I mean, is it possible to find out actual IP behind this?

Tracking IPs is part of our job to figure out fake paid traffic to block it. But due to this, it's becoming impossible to block it.

Improve this question
1
  • Your server access logs are probably only reporting on the connection directly to your server. Any user that connects through a proxy or VPN will have a different client IP. Whereas GA runs on the client so is probably able to get the true external IP of the client connecting to your site. Multiple real users apparently connecting through a single IP addresses does suggest a proxy/VPN?
    – DocRoot
    Feb 26, 2019 at 0:35

1 Answer 1

Reset to default
4

Arin.net shows that this is /16 subnet mask meaning that RGH has 65K IP address in their subnet. That's quite a few IP addresses given that many companies NAT their internal networks anymore for security purposes. You might reach out to the IT team at RGH to see if they're leasing out some of their IP addresses to any ISPs. If they were, then you probably wouldn't see the real source IP address of your clients.

You can find their point of contact at https://whois.arin.net/rest/net/NET-162-30-0-0-1/pft?s=162.30.18.58

Improve this answer
2
  • "you probably wouldn't see the real source IP address of your clients" - but that would presumably only happen if the IP was being used for some kind of proxy server? Not simply leased to an ISP?
    – DocRoot
    Feb 26, 2019 at 0:28
  • @DocRoot yes. A proxy/firewall/NATted environment would presumably all block the IP address. I'm guessing if they were leasing an address, the ISP would be routed through the hospital's network (like a VPN or proxy), which is why he may be seeing the hospital as the source address.
    – Trebor
    Feb 26, 2019 at 0:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.