2

Looking at Google Analytics recently I noticed a strange phenomenon. For the past few weeks I had 3 unique users making 600 requests for an URL that is not being used anymore.

I investigated further by looking at some access logs, and I could see one of these burst of requests. It's coming from a single IP address (using IE10.0 on Windows 7) and making a legitimate request for an existing URL. But after that initial request, I see 10-27 requests for that old inactive URL, one request every second on average. After that there is another legitimate request for another URL, 10-27 requests for the old URL, etc. and the pattern repeats itself.

I contacted the company that the IP address belongs to, but couldn't get any reason for the odd requests. Could it be that their browser has some plugin or malware or something that is sending these bursts of requests when they visit my site? Has anybody seen anything like this before? Besides being just annoying in general, it's really messing up my Google Analytics.

Here's a sample from the log (I changed the domain name and some other stuff because they are really long):

193.183.71.20 - - [25/Nov/2014:01:41:55 -0600] "GET /swe/ HTTP/1.1" 200 14009 "-" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)"
193.183.71.20 - - [25/Nov/2014:01:41:56 -0600] "GET /swe/a=3408 HTTP/1.1" 200 14050 "http://www.my-site/swe/" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)"
193.183.71.20 - - [25/Nov/2014:01:41:58 -0600] "GET /swe/a=3408 HTTP/1.1" 200 14050 "http://www.my-site/swe/a=3408" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)"
193.183.71.20 - - [25/Nov/2014:01:41:59 -0600] "GET /swe/a=3408 HTTP/1.1" 200 14050 "http://www.my-site/swe/a=3408" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)"
193.183.71.20 - - [25/Nov/2014:01:42:00 -0600] "GET /swe/a=3408 HTTP/1.1" 200 14050 "http://www.my-site/swe/a=3408" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)"
193.183.71.20 - - [25/Nov/2014:01:42:00 -0600] "GET /swe/a=3408 HTTP/1.1" 200 14050 "http://www.my-site/swe/a=3408" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)"
193.183.71.20 - - [25/Nov/2014:01:42:01 -0600] "GET /swe/a=3408 HTTP/1.1" 200 14050 "http://www.my-site/swe/a=3408" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)"
193.183.71.20 - - [25/Nov/2014:01:42:02 -0600] "GET /swe/a=3408 HTTP/1.1" 200 14050 "http://www.my-site/swe/a=3408" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)"
193.183.71.20 - - [25/Nov/2014:01:42:03 -0600] "GET /swe/a=3408 HTTP/1.1" 200 14050 "http://www.my-site/swe/a=3408" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)"
193.183.71.20 - - [25/Nov/2014:01:42:04 -0600] "GET /swe/a=3408 HTTP/1.1" 200 14050 "http://www.my-site/swe/a=3408" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)"
193.183.71.20 - - [25/Nov/2014:01:42:04 -0600] "GET /swe/a=3408 HTTP/1.1" 200 14050 "http://www.my-site/swe/a=3408" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)"
193.183.71.20 - - [25/Nov/2014:01:42:05 -0600] "GET /swe/a=3408 HTTP/1.1" 200 14050 "http://www.my-site/swe/a=3408" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)"
193.183.71.20 - - [25/Nov/2014:01:42:06 -0600] "GET /swe/a=3408 HTTP/1.1" 200 14050 "http://www.my-site/swe/a=3408" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)"
193.183.71.20 - - [25/Nov/2014:01:42:07 -0600] "GET /swe/a=3408 HTTP/1.1" 200 14050 "http://www.my-site/swe/a=3408" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)"
193.183.71.20 - - [25/Nov/2014:01:42:07 -0600] "POST /search-redirect.php HTTP/1.1" 302 - "http://www.my-site/swe/" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)"
193.183.71.20 - - [25/Nov/2014:01:42:08 -0600] "GET /swe/search/2014 HTTP/1.1" 200 14830 "http://www.my-site/swe/" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)"
193.183.71.20 - - [25/Nov/2014:01:42:09 -0600] "GET /swe/a=3408 HTTP/1.1" 200 14050 "http://www.my-site/swe/search/2014" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)"
193.183.71.20 - - [25/Nov/2014:01:42:09 -0600] "GET /swe/a=3408 HTTP/1.1" 200 14050 "http://www.my-site/swe/a=3408" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)"
193.183.71.20 - - [25/Nov/2014:01:42:10 -0600] "GET /swe/a=3408 HTTP/1.1" 200 14050 "http://www.my-site/swe/a=3408" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)"
193.183.71.20 - - [25/Nov/2014:01:42:11 -0600] "GET /swe/a=3408 HTTP/1.1" 200 14050 "http://www.my-site/swe/a=3408" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)"
193.183.71.20 - - [25/Nov/2014:01:42:12 -0600] "GET /swe/a=3408 HTTP/1.1" 200 14050 "http://www.my-site/swe/a=3408" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)"
193.183.71.20 - - [25/Nov/2014:01:42:13 -0600] "GET /swe/a=3408 HTTP/1.1" 200 14050 "http://www.my-site/swe/a=3408" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)"
193.183.71.20 - - [25/Nov/2014:01:42:14 -0600] "GET /swe/a=3408 HTTP/1.1" 200 14050 "http://www.my-site/swe/a=3408" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)"
193.183.71.20 - - [25/Nov/2014:01:42:15 -0600] "GET /swe/a=3408 HTTP/1.1" 200 14050 "http://www.my-site/swe/a=3408" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)"
193.183.71.20 - - [25/Nov/2014:01:42:15 -0600] "GET /swe/a=3408 HTTP/1.1" 200 14050 "http://www.my-site/swe/a=3408" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)"
193.183.71.20 - - [25/Nov/2014:01:42:16 -0600] "GET /swe/a=3408 HTTP/1.1" 200 14050 "http://www.my-site/swe/a=3408" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)"
193.183.71.20 - - [25/Nov/2014:01:42:17 -0600] "GET /swe/a=3408 HTTP/1.1" 200 14050 "http://www.my-site/swe/a=3408" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)"
193.183.71.20 - - [25/Nov/2014:01:42:18 -0600] "GET /swe/a=3408 HTTP/1.1" 200 14050 "http://www.my-site/swe/a=3408" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)"

As you can see, there is one initial normal page request, followed by 13 weird ones. Then there's another legitimate request (I have a .htaccess rewrite that does a 302 redirect there, but that seems to work fine for the other 99.99% of the users, so that shouldn't have anything to do with anything).

The IP belongs to a legitimate and well known company in Sweden who are among the sites' target audience.

4
  • Can you give us an example out of your log file? Also, what is/are the IP addresses. I can check to see if it is a user block for you.
    – closetnoc
    Commented Nov 26, 2014 at 16:52
  • Added a sample from the log file. What do you mean "it is a user block"?
    – Magnus
    Commented Nov 26, 2014 at 22:32
  • Some IP address blocks are subscriber blocks meaning real people use these IP addresses and some IP address blocks are used for other things such as web hosting which means machines and no real users short of employees.
    – closetnoc
    Commented Nov 27, 2014 at 2:26
  • The IP address did not give many clues on this end. I would look at ALL of the activity of this user. If there is nothing dangerous or too far off, then I would filter this IP address in Analytics if possible. Otherwise the only thing that concerns me is the POST. If there is a way to validate that the post is a real user and not a bot of some sort, then you can rest assured that all is okay. BTW- I did check that IP address in my database and the entire block seems clear from abuse activity. So I think the risk of bad behavior is rather low at this point. Just odd.
    – closetnoc
    Commented Nov 27, 2014 at 3:21

1 Answer 1

1

By and large these appear to be innocent. From the looks of things other than the search post which appears as though it is more than likely legitimate either the user is refreshing the page constantly, which depending on the site could be believable, or there is something wrong on the users browser such as malware on the machine or browser reconfiguration which is causing the browser to refresh constantly. The user agent string appears to be a legit IE sequence, although this can be spoofed, and the timeframe of one a second and a few spots of two a second also tends to make me think client side glitch. This does not appear to be a genuine attack, more than likely someone has some malware on their machine and when they try to access a website the browser keeps refreshing on them.

I wouldn't be overly concerned at this point about it unless the constant refreshed start to affect your sites performance or you see more unusual or numerous POST requests.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.