Help solving a tracking problem.

Multiple hits from same IP, refered from different serps, within seconds

[mipapage]

Okay,

So I'm toying around with a tracking script. Looking thru a few days results and I'm finding this happening a few times in the data:

• Multiple hits from the same IP each 10-30 seconds apart.
  
• The hits come from different search engines (Y!, Google + direct G IP's), for identical search terms.
  
• The user agent shows as IE using some version of Win (agent and OS case dependant)
  
• Takes cookies
  

Is this a search engine spider that is spidering Serps and masquerading as a browser? Whew, if it is, so much for keeping SE spiders from my tracking data!

Weird that it takes cookies though - maybe a class at school all searching the same topic?

[troels nybo nielsen]

> maybe a class at school all searching the same topic?

Does not sound unlikely. I've seen that happen. Is it exactly the same IP address or do the numbers after the last dot differ? Have you tried to identify the IP in a whois?

[mipapage]

Is it exactly the same IP address or do the numbers after the last dot differ?

Hmm.. Sometimes yes, others no. It's more common to see them all the same, but I have seen the last 3 differ.

I've also seen the query differ a bit too; sometimes in all caps, sometime a word or two different.

Have you tried to identify the IP in a whois?

A few of them, yep (just now, thanks, I was so busy looking for patterns that I didn't even think to lookup ip's <bangs head on wall>) - one resolves to a university, the other to a mexican group called 'collective mind', another to a telco, another to 'Secretaria de Educacion Publica'.

So, in the end it looks like some may be classes, while others still up for debate. For tracking purposes this eases the mind a bit.

I wonder what the Adsense team thinks when we (consistently, I'm assuming) get multiple clicks from the same IP within 30 minutes of each other!

[troels nybo nielsen]

I am really an ignoramus in this field (as in so many others) so if I write something silly the experts will have to chime in.

I am not sure how much it is possible for a visitor to spoof in the user agent that is shown in your logs, but you certainly have to consider the possibility that you have found somebody who are trying to hide something. There are so many weird people on the Internet with agendas unknown and sometimes incomprehensible to you and me.

If the last ciphers in the IP address are different this should normally signal different computers in one internal network.

I believe that the Adsense people know all the dirty tricks out there and are able to recognize patterns. The patterns that you describe do not sound like yourself trying to boost the statistics.

Headbanging most likely will not sharpen your sense for the obvious! ;)

[no_entry]

Perhaps it is from meta-search engines.
They each use a different format of the
search term to submit to each engine.

Regards, NE

[mipapage]

Headbanging most likely will not sharpen your sense for the obvious! ;)

This appears to be true. ;-]

no_entry,

Thanks. Wouldn't they have to click thru though in order to be put in the logs - this would result in only one referer, no?