Forum Moderators: phranque

Suspicious visitors

Suspicious visitors

         

Wmff

9:08 pm on Jul 14, 2026 (gmt 0)

Top Contributors Of The Month



Am I being paranoid? I have been getting large numbers of visits that all "seem" to have something in common. They all visit the same page or 1 of the same 2 pages. They all have the same user agent data, most have no referrer but occasionally a large number in a short time frame will all report Google.
The data in the tracking service screen shots matches up with the data in my server logs:

tracking service data:
(1) Initial Referrer: (No referring link)
ISP: Frontier CommunicationsPlatform / Resolution: Desktop / 1920x1080
IP Address: 47.201.98.xx — OS: Linux
Location: [United States] Zephyrhills, Florida, United StatesBrowser: Chrome 149.0

server log:
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36

tracking service data:
(2) Initial Referrer: (No referring link)
ISP: T-mobile UsaPlatform / Resolution: Desktop / 1920x1080
IP Address: 172.59.196.xx— OS: Linux
Location: [United States] Garland, Texas, United StatesBrowser: Chrome 149.0

server log:
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
[server reported this IP - 2607:fb91:4612:e5ab:be5c:17ff:fe0e:f9ce]

To me this does not look like a normal human visitor but may either be malicious bot/botnet or someone using a VPN or proxy server.
What's your opinion?


[edited by: not2easy at 10:05 pm (utc) on Jul 14, 2026]
[edit reason] anonymized IP [/edit]

not2easy

10:16 pm on Jul 14, 2026 (gmt 0)

WebmasterWorld Administrator 10+ Year Member Top Contributors Of The Month



Sorry for the edits, but we anonymize IPs reported - but that is in the Spiders and UAs forum: [webmasterworld.com...] so you probably wouldn't know that. The IPs appear to be residential IPs but those are sometimes compromised devices. It is not unusual for ISPs to shuffle IPs, at any rate, so behavior is more decisive than IPs.

Apple devices may indicate the IP as IPv6 as you show here (2607:fb91:4612:e5ab:be5c:17ff:fe0e:f9ce)

PS. the forum's software uses square brackets so it made the text tiny and were changed to parentheses.