Results 1 to 10 of 10

Thread: Odd proxy list usage from Denmark

  1. #1
    nux
    nux is offline Moderator
    Join Date
    Dec 2008
    Location
    Minneapolis
    Posts
    534
    Thanks
    28
    Thanked 77 Times in 54 Posts

    Odd proxy list usage from Denmark

    Hey there, I'm seeing this really odd issue. I'm getting a crap load of visitors from Denmark each day on proxysites.net. They all come from bing for 'proxy list' which I don't even rank near the top for (second page).

    They come in and go through about 60 pages on average, from different IPs, in different cities, mostly on IE and using Windows.

    Anyone else see anything like this? Here's a screenshot:

    http://www.nux.net/img/575103a2de942...d49d2daf3a.png

    I was thinking of banning everyone from Denmark, who comes via bing and uses internet explorer. Kind of a pain to code in - but it's inflating my page views, ad ctr and impressions.

    Any thoughts?

    Edit: More screenshots from Piwik

    http://www.nux.net/img/6dce663064e02...6ee4b39827.png
    http://www.nux.net/img/cda0f2bb1fde3...3cd385033c.png
    Submit Your Proxies @ NewProxySites.com

  2. #2
    CyberTroop's Avatar
    CyberTroop is offline Policing the Net...
    Join Date
    Jan 2011
    Location
    Louisiana, USA
    Posts
    42
    Thanks
    4
    Thanked 1 Time in 1 Post
    You can send that traffic over my way if you really want to get ride of it: proxyguru.com

    You might want to try out BlockScript over at Proxy.org.

    It doesn't look like your getting a majority of traffic from that country anyways. So you might want to block it.

  3. #3
    UncleP's Avatar
    UncleP is offline The perfect face for radio
    Join Date
    Nov 2009
    Location
    Blighty
    Posts
    218
    Thanks
    20
    Thanked 91 Times in 61 Posts
    I had this problem some months ago now on topproxylist.net and it is a pain because the visitors just load pages. Not just one page but every page, one after another with no 'stay' time. It makes the ctr average lower for the site stats overall and they don't click ads or proxy links. I wondered if it was bots myself, or compromised (infected) computers. The problem only seems to come from Denmark and only from bing referals though, so I couldn't figure it out. I have already blocked Danish traffic and redirect it back to bing, there wasn't many natural visitors from there anyway so I don't think I'm missing much. I'd rather lose a couple of visitors than be swamped by non-paying traffic that ruins my statistics. It doesn't appear to be a problem on moreproxies.com (yet, touch wood) but I do keep an eye on the visitors and if it becomes an issue I'll bounce the Danish traffic from that as well.

    I'd say get rid for definite, there's no benefit to having them so put up the 'keep out' signs.

    @CyberTroop: Trust me, you don't want it, it's not like 'real' visitor traffic at all.
    If I can't be a good example, I'll just have to be a terrible warning...

  4. #4
    nux
    nux is offline Moderator
    Join Date
    Dec 2008
    Location
    Minneapolis
    Posts
    534
    Thanks
    28
    Thanked 77 Times in 54 Posts
    Thanks for the responses. Seems I'm not the only one affected. I put together some quick code to watch for this.

    It checks to see if the country is DE (via geoip), if the search string is 'proxy list' and if the referring host is bing. This in theory will stop all false positives.

    Here's the code:

    Code:
    <?php
    
    function seQueryString($url = false) {
    
        if(!$url) {
       $url = isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : false;
        }
        if($url == false) {
       return '';
        }
    
        $parts = parse_url($url);
        parse_str($parts['query'], $query);
    
        $search_engines = array(
       'bing' => 'q',
       'google' => 'q',
       'yahoo' => 'p'
        );
    
        preg_match('/(' . implode('|', array_keys($search_engines)) . ')\./', $parts['host'], $matches);
    
        return isset($matches[1]) && isset($query[$search_engines[$matches[1]]]) ? $query[$search_engines[$matches[1]]] : '';
    
    }
    
    include_once('geoip.inc');
    $gi = geoip_open('GeoIP.dat',GEOIP_STANDARD);
    
    $country = geoip_country_name_by_addr($gi, $_SERVER["REMOTE_ADDR"]);
    $url = parse_url($_SERVER['HTTP_REFERER']);
    
    if ($country == "Denmark" && seQueryString() == "proxy list" && $url['host'] == "www.bing.com") {
      echo "Detected invalid usage.  If you have an issue with this please email webmaster at yourdomain dot net.  Thanks!";
      //error_log("A custom error has been triggered",1,"your@email.net","From: webmaster@yoursite.net");
      die();
    }
    What I do then is add this to the very top of includes/functions.php after the <?php tag

    Code:
    include('searchtest.php');
    searchtest.php is the file name of the code posted above.

    Be sure to have geoip.inc and GeoIP.Dat in the includes/ folder

    I did run into an issue with the /feed/index.php file would error out because it couldn't find the geoip files.

    What I did to fix this (kind of a hack) is create symlinks from /feed/geoip.inc to ../includes/geoip.inc and /feed/GeoIP.dat to ../includes/GeoIP.dat and it seemed to resolve the issue.

    Not the prettiest of resolutions but it works, and should be modifiable enough to suit your needs and not generate any false positives.

    Hope this helps.

    Thanks,
    -nux
    Submit Your Proxies @ NewProxySites.com

  5. Thanked by:

    UncleP (5 February, 2011)

  6. #5
    tibbie is offline Unknown Net Builder
    Join Date
    Apr 2009
    Posts
    106
    Thanks
    6
    Thanked 6 Times in 5 Posts
    Quote Originally Posted by nux View Post
    Hey there, I'm seeing this really odd issue. I'm getting a crap load of visitors from Denmark each day on proxysites.net. They all come from bing for 'proxy list' which I don't even rank near the top for (second page).

    They come in and go through about 60 pages on average, from different IPs, in different cities, mostly on IE and using Windows.

    Anyone else see anything like this? Here's a screenshot:

    http://www.nux.net/img/575103a2de942...d49d2daf3a.png

    I was thinking of banning everyone from Denmark, who comes via bing and uses internet explorer. Kind of a pain to code in - but it's inflating my page views, ad ctr and impressions.

    Any thoughts?

    Edit: More screenshots from Piwik

    http://www.nux.net/img/6dce663064e02...6ee4b39827.png
    http://www.nux.net/img/cda0f2bb1fde3...3cd385033c.png
    I get about a thousand a day both to my toplist and my forum. Definitely banning - useless traffic.

  7. #6
    codename_B's Avatar
    codename_B is offline PHP Coder
    Join Date
    Jan 2011
    Posts
    106
    Thanks
    9
    Thanked 14 Times in 11 Posts
    What are their user agents like?
    http://find-new-proxies.com Auto Approval Proxy List
    http://uf6.info Free Text File Hosting

  8. #7
    nux
    nux is offline Moderator
    Join Date
    Dec 2008
    Location
    Minneapolis
    Posts
    534
    Thanks
    28
    Thanked 77 Times in 54 Posts
    IE7-8 is what they're reporting.
    Submit Your Proxies @ NewProxySites.com

  9. #8
    tibbie is offline Unknown Net Builder
    Join Date
    Apr 2009
    Posts
    106
    Thanks
    6
    Thanked 6 Times in 5 Posts
    before I banned danish traffic my stats had gone up you 8000 a day! Now a more reasonable 500 a day. It was both on my proxy list and my forum.

  10. #9
    oxuro's Avatar
    oxuro is offline Extreme Developement going on..
    Join Date
    Sep 2009
    Location
    Greece
    Posts
    121
    Thanks
    3
    Thanked 13 Times in 11 Posts
    Same here on one of my proxy lists , looks really weird.

    The traffic spiked up for a couple of days and then back to semi-normal.

    I still wonder how the heck that happened, could it be a maliware on IE ? o.O

  11. #10
    nux
    nux is offline Moderator
    Join Date
    Dec 2008
    Location
    Minneapolis
    Posts
    534
    Thanks
    28
    Thanked 77 Times in 54 Posts
    It is very confusing. I just don't get what the purpose is. I have modified my code to simply block any one from DE coming from Bing. A lot simpler than checking the actual keyword used to search.

    It almost feels like some sort of botnet, or some distributed application working to gather information. There must be some purpose, but I've yet to see it. Maybe someone is scraping proxy lists to popular their own list?

    I dunno
    Submit Your Proxies @ NewProxySites.com

Similar Threads

  1. Web Proxy List_Proxy List,Free Web Proxy List,Submit your proxies for free
    By webproxylist in forum Proxy List Announcements
    Replies: 0
    Last Post: 10 December, 2010, 19:10 PM
  2. [Free] New Proxy List Website - Submit Your Proxy Websites Now
    By clickkt in forum Proxy List Announcements
    Replies: 2
    Last Post: 1 July, 2010, 17:38 PM
  3. Replies: 2
    Last Post: 1 April, 2010, 15:51 PM
  4. Replies: 0
    Last Post: 19 March, 2010, 03:26 AM
  5. Replies: 11
    Last Post: 6 July, 2009, 20:08 PM

Tags for this Thread

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •