1

thanks in advance for the help. This isn't my usual job, but our website admin/full stack developer is on leave and my boss has asked me to look into it. Recently we've had a huge spike (talking tens of thousands of hits here) in what looks to be automated traffic coming from China and Singapore. This traffic shows up in Cpanel and not google analytics. Worse, it's hitting on urls with a long string of characters appended to them that I don't understand. Examples:

https://www.url.com/productpage.html%25252523features%252523specifications%2523relatedproducts%23eCImg
   or 
https://www.url.com/productpage2.php%25252523TB_inline%2525253Fheight%2525253D600%25252526width%2525253D720%25252526inlineId%2525253Dindusoftdcon%252523TB_inline%25253Fheight%25253D800%252526width%25253D720%252526inlineId%25253Dupac7186eg%2523TB_inline%253Fheight%253D250%2526width%253D720%2526inlineId%253DI-7540D

This activity was coming from a pretty narrow range of IPs so i went ahead and banned them, but I still don't understand what's going on. Any advice you all can give would be great :)

Improve this question

1 Answer 1

Reset to default
2

If the traffic is not reported in Analytics then that's a good sign it's spam traffic. Analytics blocks known bot and spam traffic by default from showing up in your reports.

As to why a spammer would be doing this... your guess is as good as anyone's. It seems tb_inline refers to a wordpress plugin (thickbox)? It could be a dumb crawler that doesn't know how to handle that pop up dialog and keeps hitting it over and over.

Improve this answer
2
  • Thanks for the input. Spam traffic isn't something I'm too worried about, as long as they're not doing anything malicious.
    – Nilco
    Commented Aug 28, 2019 at 19:53
  • 1
    @Nilco no way to know, but probably safe to assume the worst. Blocking IPs is a good measure. Also, you can look through your logs to see if any of non-existent pages seem kind of fishy. Things like admin.php or dashboard. That could be indicative of a vulnerability scanner.
    – smilebomb
    Commented Aug 28, 2019 at 19:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.