5

Just a few hours back I was checking my logs when I found a whole bunch of traffic from IP address 54.174.xx.xx and ISP Amazon.com (validated from Google analytics). It lasted for an hour and then everything seems normal.

This is something very abnormal. I investigated further and am confused to find that it wasn't actually a bot (well I guess so) because I can see users (for example with ip 54.174.59.201) has even clicked thumbnails in the sidebar. However browsers, OS and screen resolutions are same for all sessions.

What's the cause and what to do?

enter image description here

Improve this question
10
  • Ashburn is home to many data centres, and there are a few things you can check to try to determine the nature of the traffic: source/medium, landing page, network domain... you'll need to try and find a pattern here, but unfortunately, it may be something that you won't be able to avoid, as the traffic could be legitimate.
    – nyuen
    Commented Nov 27, 2015 at 1:36
  • Can you pls elaborate a bit? Landing pages vary with session although 8-10% are similar. Source/medium is Direct or not set. I suspect foul play mainly because there's too many sessions with same browser/OS/resolution and similar IP.
    – Ramnath
    Commented Nov 27, 2015 at 1:42
  • What are the landing pages? In most cases, if it's bot activity, the landing pages may all be the same. Also check bounce rates.
    – nyuen
    Commented Nov 27, 2015 at 2:58
  • @nyuen is making a valid point. It would be far better for us to see the log entries themselves in order to tell you what they are really up to. Please know that Amazon as an ISP is very permissive and is #2 in my abuse database the last time I did an audit which has been a while ago. There are many who use Amazon to scrape and abuse websites. Keep in mind short of an employee, this is not likely a user. It is likely a machine and therefore safe to block. I only blacklist two networks, archive.org and amazon.
    – closetnoc
    Commented Nov 27, 2015 at 3:07
  • @closetnoc so is the reason you block archive.org and amazon - because they effectively turn a blind eye to the activity of their customers on their network?
    – the_velour_fog
    Commented Nov 27, 2015 at 13:58

3 Answers 3

Reset to default
2

The thing you need to be careful of here is that Amazon is not simply a website provider but is also a cloud services provider and also has a service whereby users can access a virtualized desktop interface on the Amazon network as a remote desktop session. This particular service uses a Windows Server gateway and so the desktop resolution and OS fingerprint will generally be the same. Simply having these entries show up in your logs is not an inherently bad thing unless you are seeing traffic that indicates they are trying to breach your site security or they are using the services to perform malicious actions or spamming on your site.

Improve this answer
2

We had the same issue and it turned out to be Pingdom (website monitoring service).

Someone had configured it to ping our site every 5 minutes and login which resulted in thousands of hits per month from Ashburn, VA with a service Provider of Amazon. Time on site was just a fraction of a second each time.

Pingdom suggests enabling blocking known bot traffic via a setting in GA: https://help.pingdom.com/hc/en-us/articles/212979949-What-analytics-will-Pingdom-checks-and-products-trigger-

Improve this answer
2
  • We have been using Pingdom for a long time but never had a problem like that!
    – Ramnath
    Commented Mar 10, 2017 at 0:27
  • Pingdom explains that: "Since Pingdom has different services the behaviour in triggering various analytics you might have on your site will differ. Basic/Uptime checks will not trigger any analytics that use JS." In our case, we use a service that actually logs in on our site to verify auth is working, which does execute JS and thus triggers our Google Tag Manager/GA.
    – Justin
    Commented Mar 10, 2017 at 16:29
2

NOTE: I'd call myself a n00b developer from Down Under.

In relation to the OP, a Google search of the below IP lead me here.

As an effort to minimize Spam, setup this bad bot blackhole as per: https://perishablepress.com/blackhole-bad-bots/

First hit reported by Blackhole, in part, was:

Tuesday, November 27th 2018 @ 11:36:37

URL Request: /blackhole/ IP Address: 52.200.221.20 User Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.2 (KHTML, like Gecko) Chrome/22.0.1216.0 Safari/537.2

Whois Lookup:

ARIN WHOIS data and services are subject to the Terms of Use available at: https://www.arin.net/whois_tou.html If you see inaccuracies in the results, please report at https://www.arin.net/resources/whois_reporting/index.html Copyright 1997-2018, American Registry for Internet Numbers, Ltd.

NetRange: 52.192.0.0 - 52.223.255.255 CIDR: 52.192.0.0/11 NetName: AT-88-Z NetHandle: NET-52-192-0-0-1 Parent: NET52 (NET-52-0-0-0-0) NetType: Direct Allocation OriginAS:
Organization: Amazon Technologies Inc. (AT-88-Z) RegDate: 2015-09-02 Updated: 2015-09-02 Ref: https://rdap.arin.net/registry/ip/52.192.0.0 OrgName: Amazon Technologies Inc. OrgId: AT-88-Z Address: 410 Terry Ave N. City: Seattle StateProv: WA PostalCode: 98109 Country: US RegDate: 2011-12-08 Updated: 2017-01-28

If it was a legit bot, it should NOT have tried to access this directory /blackhole because robots.txt specifically Disallowed this.

AbuseIPDB reports: 52.200.221.20 was found in our database!

This IP was reported 49 times. Confidence of Abuse is 43%

To me, the blackhole code shows that this not to be legit behaviour and now that IP is banned from accessing the site that it targeted. So vigilance is certainly paramount.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.