13 {{ upvoteCount | shortNum }}
13 {{ upvoteCount | shortNum }}

Google bot or hacker?

by TheEliteWarrior
7 replies
  • ECOMMERCE
    • |
Hey guys,

I've had more than 20 visits from someone/thing from San Jose, California with the same IP address visiting almost all of the pages on my site. I was wondering if anyone knew if it was a Google bot or anything else. Perhaps some of you might have come across this in the past.

Here are some details:
  • IP Address: 38.99.82.191
#bot #google #hacker
  • Profile picture of the author MKaren
    Originally Posted by TheEliteWarrior View Post

    Hey guys,

    I've had more than 20 visits from someone/thing from San Jose, California with the same IP address visiting almost all of the pages on my site. I was wondering if anyone knew if it was a Google bot or anything else. Perhaps some of you might have come across this in the past.

    Here are some details:
    • IP Address: 38.99.82.191
    Clean your browser to avoid hakers..HI have similar experience..
    Signature
    Upwork links are not allowed in signatures
    {{ DiscussionBoard.errors[7719097].message }}
    • Profile picture of the author TheEliteWarrior
      Originally Posted by MKaren View Post

      Clean your browser to avoid hakers..HI have similar experience..

      Apparently it's a hacker bot, it commonly visits new sites and it is detrimental in the long-run according to this forum thread:

      Weird Site Traffic Coming From San Jose, California | Fresh Marketing Forum

      Anyone know how to reverse the negative effects of this hacker bot(i.e., a reduction of traffic as compared to before this bot appeared)? Would blocking that IP address be sufficient?
      {{ DiscussionBoard.errors[7720006].message }}
      • Profile picture of the author konakid
        I imagine blocking the IP address would be fine. If it comes back with a different IP you might have to figure something out, but I feel like it's probably an automated bot just checking for vulnerabilities. Probably not out to get specifically you.
        {{ DiscussionBoard.errors[7722268].message }}
  • Profile picture of the author jminkler
    Getting hit from here today, blocked IP
    {{ DiscussionBoard.errors[9233949].message }}
  • Profile picture of the author kilgore
    If you're really concerned, as stated above you can block the IP. But if you monitor your log files as closely as I do, at some point you'll probably notice that a different IP address is scanning you. Then another. Then another. And another. And 20 visits isn't even that many. I've had bots running thousands of requests at my site in a manner of minutes.

    Most of these bots are looking for vulnerabilities, often (or even usually) for software that you aren't even running. In general, I don't bother blocking an IP address as most likely once they're done with their scan that IP address will never hit you again -- it's already moved onto looking for another victim. I do sometimes block certain URL patterns (such as requests containing /etc/passwd), but really the best thing to do is make sure your software is always up to date and secure, both the servers you're running on and the web applications themselves. You might also consider using a log file visualizing service like Loggly, SumoLogic, Splunk or Papertrail which makes it very easy to see when you've been getting unusual requests or other suspicious patterns.

    Finally, you can check out stuff like apache's mod_evasive (if you're using apache) or third party services such as Cloudflare or Incapsula which claim to recognize suspicious traffic and help prevent against it. I haven't tried these myself yet, but they do look like they could be promising.
    Signature
    {{ DiscussionBoard.errors[9234871].message }}
  • Profile picture of the author damoncloudflare
    Originally Posted by TheEliteWarrior View Post

    Hey guys,

    I've had more than 20 visits from someone/thing from San Jose, California with the same IP address visiting almost all of the pages on my site. I was wondering if anyone knew if it was a Google bot or anything else. Perhaps some of you might have come across this in the past.

    Here are some details:
    • IP Address: 38.99.82.191
    Definitely not a googlebot. Project Honeypot doesn't show anything bad happening on the IP at this time.
    Signature

    Damon
    CloudFlare Community Evangelist

    Tips for using WordPress with CloudFlare

    {{ DiscussionBoard.errors[9244971].message }}
  • Profile picture of the author JimmyBearden
    This IP Visited my site 247 times in 2 days for less than a minute on each occurrence.
    {{ DiscussionBoard.errors[10147548].message }}

Trending Topics