5

We've noticed an unusual and growing pattern in visits to our website.

When a user visits, we set a PHP session ID, set cookies, and record the user agent and ip.

What we've seen happening a lot recently is a visit from a user who has no PHP session ID and no cookies set by us. Then within the next second, we get multiple visits from different users who have:

  • the same PHP session ID as the first visitor
  • same cookies as the first visitor
  • IPs all different from each other (geolocation usually shows different countries for the different IPs)
  • user_agents all different from each other (e.g, iPhone, Win7, tablet, Android, etc)

In one second, we get 5-20 of these visits. Some have http_referer strings (usually google pages of countries which correspond to the IP), some have nothing.

Then, we never see it again: not that PHP session ID, not the cookies we set, not the IPs.

For us, we never saw this until the last few months. It started slowly at the end of June 2014, and has now grown steadily to be very many.

We looked through these answers. We might be wrong, but they don't seem to apply to our situation:

The same user from different IP-addresses?
(the users in this question are being routed through different proxies, but it's within 30 seconds, and not several all within one second; also not presumably from IPs of different countries)

https://stackoverflow.com/questions/15966812/user-recognition-without-cookies-or-local-storage
https://stackoverflow.com/questions/13412864/same-session-id-on-same-ip-address-but-different-ports

And this question addresses different session IDs from a single IP:
https://stackoverflow.com/questions/12712033/different-session-id-from-the-same-ip-on-the-same-time
but our situation is the opposite since we have the same session ID from multiple IPs.

Anyone else seen this? Any idea what this is?

What's the best way to stop this most efficiently?

Improve this question
9
  • Have you analyzed the traffic? Are they making GET requests or POST? If POST what is the payload? I've seen similar reports of such issues and while it could be an attack. In several cases I found it was improper session management by the application itself.
    – jeffatrackaid
    Oct 28, 2014 at 13:53
  • Some rouge or stealth spider software will try and forge session id's and fake cookies. They can use open proxies of all kinds that are not easily tracked or recognized. If these are get statements and often valid, then it is likely a bot operated by a scraper. If there are post requests, then this at least landscaping if not outright hack attempts against one or various web applications and possibly PHP and Java environments.
    – closetnoc
    Oct 28, 2014 at 16:47
  • 1
    When you say "the same PHP session ID as the first visitor", do you mean the PHP session ID you assigned the first visitor (the one who came in with no session ID at all?). They might be testing to see how your site looks (server side) in different browsers (ie, whether you tailor content to the browser)
    – user3919
    Oct 28, 2014 at 18:28
  • @jeffatrackaid, it's GET requests.
    – LeeWenzu
    Oct 29, 2014 at 7:23
  • @barrycarter, sorry if not clear. We assign a PHP session ID to a new visitor and set some cookies. Then, in the next second we see several more visitors who have that same PHP session ID and the same cookies which we assigned to the first visitor. These other visitors have different IPs, user_agents from the first visitor although they have the same (unique) PHP session ID and (unique) cookies which we assigned to the first visitor. After a wave of 5-20 visitors in that second, we never again see visitors who have the cookies, or who come from those IPs.
    – LeeWenzu
    Oct 29, 2014 at 7:26

1 Answer 1

Reset to default
1

I do... By that I mean that my mobile browser chrome had a new feature lately: Passing by a proxy for compressing the website before sending me the download...

For that, google have multiple i.p. change for every different visits because well it's some sort of derivated proxy each time...

I disabled it because it reset my loggedin credential of my coding app f.t.p. on server application every single time... (i.p. change protected server connection...) At the first time I was like trying and trying to reconnect like crazy pulling out my hair and when I calm down I finally figured out what was changed from last time...

So when somebody have an mobile that trying to compress web content before sending him it pass by an different proxy but session and cookies are kept...

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.