Thread: Odd proxy list usage from Denmark

Hey there, I'm seeing this really odd issue. I'm getting a crap load of visitors from Denmark each day on proxysites.net. They all come from bing for 'proxy list' which I don't even rank near the top for (second page).

They come in and go through about 60 pages on average, from different IPs, in different cities, mostly on IE and using Windows.

Anyone else see anything like this? Here's a screenshot:

http://www.nux.net/img/575103a2de942...d49d2daf3a.png

I was thinking of banning everyone from Denmark, who comes via bing and uses internet explorer. Kind of a pain to code in - but it's inflating my page views, ad ctr and impressions.

Any thoughts?

Edit: More screenshots from Piwik

http://www.nux.net/img/6dce663064e02...6ee4b39827.png
http://www.nux.net/img/cda0f2bb1fde3...3cd385033c.png

You can send that traffic over my way if you really want to get ride of it: proxyguru.com

You might want to try out BlockScript over at Proxy.org.

It doesn't look like your getting a majority of traffic from that country anyways. So you might want to block it.

I had this problem some months ago now on topproxylist.net and it is a pain because the visitors just load pages. Not just one page but every page, one after another with no 'stay' time. It makes the ctr average lower for the site stats overall and they don't click ads or proxy links. I wondered if it was bots myself, or compromised (infected) computers. The problem only seems to come from Denmark and only from bing referals though, so I couldn't figure it out. I have already blocked Danish traffic and redirect it back to bing, there wasn't many natural visitors from there anyway so I don't think I'm missing much. I'd rather lose a couple of visitors than be swamped by non-paying traffic that ruins my statistics. It doesn't appear to be a problem on moreproxies.com (yet, touch wood) but I do keep an eye on the visitors and if it becomes an issue I'll bounce the Danish traffic from that as well.

I'd say get rid for definite, there's no benefit to having them so put up the 'keep out' signs.

@CyberTroop: Trust me, you don't want it, it's not like 'real' visitor traffic at all.

Thanks for the responses. Seems I'm not the only one affected. I put together some quick code to watch for this.

It checks to see if the country is DE (via geoip), if the search string is 'proxy list' and if the referring host is bing. This in theory will stop all false positives.

Here's the code:

Code:

<?php

function seQueryString($url = false) {

    if(!$url) {
   $url = isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : false;
    }
    if($url == false) {
   return '';
    }

    $parts = parse_url($url);
    parse_str($parts['query'], $query);

    $search_engines = array(
   'bing' => 'q',
   'google' => 'q',
   'yahoo' => 'p'
    );

    preg_match('/(' . implode('|', array_keys($search_engines)) . ')\./', $parts['host'], $matches);

    return isset($matches[1]) && isset($query[$search_engines[$matches[1]]]) ? $query[$search_engines[$matches[1]]] : '';

}

include_once('geoip.inc');
$gi = geoip_open('GeoIP.dat',GEOIP_STANDARD);

$country = geoip_country_name_by_addr($gi, $_SERVER["REMOTE_ADDR"]);
$url = parse_url($_SERVER['HTTP_REFERER']);

if ($country == "Denmark" && seQueryString() == "proxy list" && $url['host'] == "www.bing.com") {
  echo "Detected invalid usage.  If you have an issue with this please email webmaster at yourdomain dot net.  Thanks!";
  //error_log("A custom error has been triggered",1,"your@email.net","From: webmaster@yoursite.net");
  die();
}

What I do then is add this to the very top of includes/functions.php after the <?php tag

Code:

include('searchtest.php');

searchtest.php is the file name of the code posted above.

Be sure to have geoip.inc and GeoIP.Dat in the includes/ folder

I did run into an issue with the /feed/index.php file would error out because it couldn't find the geoip files.

What I did to fix this (kind of a hack) is create symlinks from /feed/geoip.inc to ../includes/geoip.inc and /feed/GeoIP.dat to ../includes/GeoIP.dat and it seemed to resolve the issue.

Not the prettiest of resolutions but it works, and should be modifiable enough to suit your needs and not generate any false positives.

Hope this helps.

Thanks,
-nux

Originally Posted by nux

Hey there, I'm seeing this really odd issue. I'm getting a crap load of visitors from Denmark each day on proxysites.net. They all come from bing for 'proxy list' which I don't even rank near the top for (second page).

They come in and go through about 60 pages on average, from different IPs, in different cities, mostly on IE and using Windows.

Anyone else see anything like this? Here's a screenshot:

http://www.nux.net/img/575103a2de942...d49d2daf3a.png

I was thinking of banning everyone from Denmark, who comes via bing and uses internet explorer. Kind of a pain to code in - but it's inflating my page views, ad ctr and impressions.

Any thoughts?

Edit: More screenshots from Piwik

http://www.nux.net/img/6dce663064e02...6ee4b39827.png
http://www.nux.net/img/cda0f2bb1fde3...3cd385033c.png

I get about a thousand a day both to my toplist and my forum. Definitely banning - useless traffic.

What are their user agents like?

IE7-8 is what they're reporting.

before I banned danish traffic my stats had gone up you 8000 a day! Now a more reasonable 500 a day. It was both on my proxy list and my forum.

Same here on one of my proxy lists , looks really weird.

The traffic spiked up for a couple of days and then back to semi-normal.

I still wonder how the heck that happened, could it be a maliware on IE ? o.O

It is very confusing. I just don't get what the purpose is. I have modified my code to simply block any one from DE coming from Bing. A lot simpler than checking the actual keyword used to search.

It almost feels like some sort of botnet, or some distributed application working to gather information. There must be some purpose, but I've yet to see it. Maybe someone is scraping proxy lists to popular their own list?

I dunno