We've noticed an unusual and growing pattern in visits to our website.
When a user visits, we set a PHP session ID, set cookies, and record the user agent and ip.
What we've seen happening a lot recently is a visit from a user who has no PHP session ID and no cookies set by us. Then within the next second, we get multiple visits from different users who have:
- the same PHP session ID as the first visitor
- same cookies as the first visitor
- IPs all different from each other (geolocation usually shows different countries for the different IPs)
- user_agents all different from each other (e.g, iPhone, Win7, tablet, Android, etc)
In one second, we get 5-20 of these visits. Some have http_referer strings (usually google pages of countries which correspond to the IP), some have nothing.
Then, we never see it again: not that PHP session ID, not the cookies we set, not the IPs.
For us, we never saw this until the last few months. It started slowly at the end of June 2014, and has now grown steadily to be very many.
We looked through these answers. We might be wrong, but they don't seem to apply to our situation:
The same user from different IP-addresses?
(the users in this question are being routed through different proxies, but it's within 30 seconds, and not several all within one second; also not presumably from IPs of different countries)
https://stackoverflow.com/questions/15966812/user-recognition-without-cookies-or-local-storage
https://stackoverflow.com/questions/13412864/same-session-id-on-same-ip-address-but-different-ports
And this question addresses different session IDs from a single IP:
https://stackoverflow.com/questions/12712033/different-session-id-from-the-same-ip-on-the-same-time
but our situation is the opposite since we have the same session ID from multiple IPs.
Anyone else seen this? Any idea what this is?
What's the best way to stop this most efficiently?
GET
requests orPOST
? IfPOST
what is the payload? I've seen similar reports of such issues and while it could be an attack. In several cases I found it was improper session management by the application itself.