I'm running a promotional campaign and I've noticed some strange traffic patterns. There's this singular IP address, 34.9.222.153, that's showing up in our logs with a ton of clicks, but it seems like all the requests are just going to our tracking link and nothing beyond that. To break it down a bit:
1. We use a URL shortener to track where traffic comes from, which then redirects to the actual page.
2. There's a reverse-proxy in front of the shortener that logs the traffic.
When I check the logs for this IP, it only makes requests to the tracking URL, but doesn't request the actual content that it should be redirected to. I also noticed there aren't any other traffic bursts at the same time, so it doesn't look like it's coming from a proxy or other sources. This IP is a Google Cloud address, and I couldn't find any information about it online. Most of our clicks are coming from this IP, and it looks like fake traffic. I'm considering banning it to keep our metrics accurate. Does anyone have any insight on what might be happening?
3 Answers
Sounds like a spam bot or something similar, just sifting through your links. Blocking it might help, but it might also flag your emails as spam if it's related to your marketing efforts. You might want to look into excluding it from your metrics instead of fully banning it, unless it's really harmful.
Yeah, I've noticed the same IP behaving like that in my past work. It's definitely bogus traffic, but I can't figure out why someone would set it up in the first place.
I've seen similar situations where bots hammer e-commerce sites, probably trying to scrape info or something. No clue why they do it, though.
Is your URL shortener public? That could explain it—maybe it's archiving the redirects. Check out the URLTeam Wiki for more info.
It's actually a self-hosted tool, so that shouldn't be the issue.
The links with that IP weren't used in emails; they were shared in places like Reddit. It's definitely skewing my metrics, so I just blocked it since it seemed to be fake.