• This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn more.

How do I deal with lots of genuine or not traffic from a single IP?

Stuart Wright

Well-known member
#1
So we've notice via Google Analytics Real-Time reports that a bit under 10% of our online users are using iPads in Toronto. It's been this story for at least 24 hours with the top 3 pages here being the three being accessed.
The PicturePerfect and custom installer map pages don't normally get more traffic than any of the other pages, so this prolonged spike is very unusual.

upload_2014-10-29_21-20-17.png

I got our host to send me the log file and it shows these two IPs as the sources:
67.212.94.37 - - [29/Oct/2014:05:59:52 +0000] "GET /pages/pictureperfect/ HTTP/1.1" 301 178 "-" "Mozilla/5.0 (iPad; CPU iPhone OS 501 like Mac OS X) AppleWebKit/534.46 (KHTML like Gecko) Version/5.1 Mobile/9A405 Safari/7534.48.3" "-"
67.230.168.2 - - [29/Oct/2014:05:59:52 +0000] "GET /pages/pictureperfect/ HTTP/1.1" 301 5 "-" "Mozilla/5.0 (iPad; CPU iPhone OS 501 like Mac OS X) AppleWebKit/534.46 (KHTML like Gecko) Version/5.1 Mobile/9A405 Safari/7534.48.3" "-"
How would you tackle this?
 

RobParker

Well-known member
#2
Maybe start by contacting netelligent and say you're seeing unusual traffic from one of their IPs and see if they can provide you any information?
 

Stuart Wright

Well-known member
#3
Email sent. In the mean time what I really need is a tool to monitor the IPs visiting particular pages within Xenforo.
A bit like Google Analytics real time. With whatever information we can get on whether this is a genuine visitor, a robot or a DOS attack.
 

Walter

Well-known member
#4
Piwik, the free alternative to Google Analytics (hosted by yourself), features a widget "Live!" where you can watch your visitors in real time.

If you want, I can setup a free test acount for a few days, all you would have to do is add a small Javascript code to a Xenforo temlate (e.g. ad_below_bottom_breadcrumb). I assume a few days watching this would already help?
 

Stuart Wright

Well-known member
#5
Piwik, the free alternative to Google Analytics (hosted by yourself), features a widget "Live!" where you can watch your visitors in real time.

If you want, I can setup a free test acount for a few days, all you would have to do is add a small Javascript code to a Xenforo temlate (e.g. ad_below_bottom_breadcrumb). I assume a few days watching this would already help?
Thank you. Do you happen to know (it's not obvious in the documentation) whether you can filter by IP?
I know some of the IPs causing problems. I'd probably then look at wanting to block those IPs through Xenforo.
 

Stuart Wright

Well-known member
#9
Maybe you can try tail watch logs
Don't know what that is.
I think I need an addon which shows in real time on any particular page the IPs and visitor types of the various sessions. With the ability to then filter to only see supposed human sessons. And then redirect chosen IPs to a page which either asks them whether they are human. And if they are not an option to return a 404 error for certain IPs.
 

Mouth

Well-known member
#10
I think I need an addon which shows in real time on any particular page the IPs and visitor types of the various sessions. With the ability to then filter to only see supposed human sessons. And then redirect chosen IPs to a page which either asks them whether they are human. And if they are not an option to return a 404 error for certain IPs.
Whilst not meeting these requirements, do take a look at https://xenforo.com/community/resources/dedos-anti-dos-for-spam-bot-scrapers.3305/