More Computer Bots Than Us?

I know that is a dumb question. I am shocked after I found out my site is quite busy, but none of them are real human beings.

I installed the Impression module that give me a detail report of all the activities on the site. I used views module to creating a report of all those activities. I am quite surprised to find out how big the problem is. I have attached a report for about 40 minutes' sites activities.

As you can find out from the report, In the 40 minutes period, no human activity on the website. But there are 35 bots visits. There are 32 registration form requests.

A little bit of explanation of the report. All values in the action column are 0. Which means all the activities are from bots. Because if it is a person who visits a web page, we will detect other movements like screen touch, mouse movement or keyboard movement.

Action ID Action Name
0 page load
1 Screen touch
2 Mouse move
3 Keyboard key down

Here is the report:

User ID Action ID IP URI CREATED DATE
0 0 xx.94.236.195 /?q=user/register 2015-12-28 18:59
0 0 xx.108.70.111 /user/register 2015-12-28 18:59
0 0 xxx.144.230.34 /?q=node/add 2015-12-28 18:59
0 0 xxx.144.230.34 /content/spinach-spinach-and-spinach 2015-12-28 18:59
0 0 xxx.100.55.148 /content/spinach-spinach-and-spinach 2015-12-28 18:54
0 0 xxx.82.169.157 /content/spinach-spinach-and-spinach 2015-12-28 18:53
0 0 xx.176.232.61 /user/register 2015-12-28 18:52
0 0 xx.176.232.61 /user/register 2015-12-28 18:52
0 0 xx.176.232.61 /node/add 2015-12-28 18:52
0 0 xx.176.232.61 /?q=node/add 2015-12-28 18:52
0 0 xx.176.232.61 /user/register 2015-12-28 18:52
0 0 xx.89.52.194 /?q=user 2015-12-28 18:51
0 0 xx.89.52.194 /user/register 2015-12-28 18:51
0 0 xx.89.52.194 /user/register 2015-12-28 18:51
0 0 xx.89.16.190 /?q=user/register 2015-12-28 18:51
0 0 xxx.82.170.131 /?q=node/add 2015-12-28 18:51
0 0 xxx.82.170.131 /content/spinach-spinach-and-spinach 2015-12-28 18:51
0 0 xx.72.71.69 /?q=user 2015-12-28 18:50
0 0 xx.72.71.69 /user/register 2015-12-28 18:50
0 0 xxx.222.15.14 /content/spinach-spinach-and-spinach 2015-12-28 18:50
0 0 xxx.217.171.178 /content/spinach-spinach-and-spinach 2015-12-28 18:49
0 0 xx.95.105.65 /?q=user 2015-12-28 18:49
0 0 xx.95.105.65 /user/register 2015-12-28 18:49
0 0 xxx.94.168.69 /user/register 2015-12-28 18:49
0 0 xxx.94.168.69 /user/register 2015-12-28 18:49
0 0 xxx.77.254.224 /?q=user/register 2015-12-28 18:49
0 0 xx.95.105.7 /?q=node/add 2015-12-28 18:49
0 0 xx.95.105.7 /content/spinach-spinach-and-spinach 2015-12-28 18:49
0 0 xxx.222.15.14 /content/spinach-spinach-and-spinach 2015-12-28 18:48
0 0 xxx.222.15.14 /comment/reply/53/20 2015-12-28 18:48
0 0 xxx.222.15.14 /comment/reply/53/20 2015-12-28 18:48
0 0 xx.210.181.162 /content/spinach-spinach-and-spinach 2015-12-28 18:48
0 0 xxx.69.209.169 /content/spinach-spinach-and-spinach 2015-12-28 18:47
0 0 xx.94.234.174 / 2015-12-28 18:45
0 0 xxx.227.92.115 /user/register 2015-12-28 18:44
0 0 xxx.227.92.115 /user/register 2015-12-28 18:44
0 0 xxx.3.83.153 /?q=user/register 2015-12-28 18:44
0 0 xx.95.94.79 /?q=node/add 2015-12-28 18:44
0 0 xx.95.94.79 /content/spinach-spinach-and-spinach 2015-12-28 18:43
0 0 xxx.227.92.78 /user/register 2015-12-28 18:43
0 0 xxx.227.92.78 /user/register 2015-12-28 18:43
0 0 xx.211.55.9 /user 2015-12-28 18:43
0 0 xxx.227.92.78 /node/add 2015-12-28 18:43
0 0 xxx.227.92.78 /?q=node/add 2015-12-28 18:43
0 0 xx.211.55.9 /user 2015-12-28 18:43
0 0 xx.211.55.9 /content/spinach-spinach-and-spinach 2015-12-28 18:43
0 0 xx.211.55.9 /?q=user 2015-12-28 18:43
0 0 xx.211.55.9 /user/register 2015-12-28 18:43
0 0 xxx.217.171.178 /content/spinach-spinach-and-spinach 2015-12-28 18:42
0 0 xxx.69.209.169 /content/spinach-spinach-and-spinach 2015-12-28 18:42
0 0 xxx.69.209.169 /comment/reply/53/6 2015-12-28 18:42
0 0 xxx.69.209.169 /content/spinach-spinach-and-spinach 2015-12-28 18:42
0 0 xxx.69.209.169 /comment/reply/53/6 2015-12-28 18:42
0 0 xx.35.104.150 /user 2015-12-28 18:36
0 0 xx.35.104.150 /user 2015-12-28 18:36
0 0 xx.35.104.150 /?q=user 2015-12-28 18:36
0 0 xx.35.104.150 /user/register 2015-12-28 18:36
0 0 xxx.162.199.47 /user/register 2015-12-28 18:36
0 0 xxx.162.199.47 /?q=user 2015-12-28 18:36
0 0 xx.59.49.218 / 2015-12-28 18:36
0 0 xx.59.49.218 / 2015-12-28 18:35
0 0 xxx.94.168.69 /user/register 2015-12-28 18:33
0 0 xxx.94.168.69 /user/register 2015-12-28 18:33
0 0 xxx.77.254.224 /?q=user/register 2015-12-28 18:33
0 0 xxx.94.168.133 /?q=node/add 2015-12-28 18:33
0 0 xxx.94.168.133 /content/spinach-spinach-and-spinach 2015-12-28 18:33
0 0 xxx.144.227.34 /?q=user 2015-12-28 18:32
0 0 xxx.144.227.34 /user/register 2015-12-28 18:32
0 0 xxx.144.227.34 /user/register 2015-12-28 18:32
0 0 xx.94.237.96 /?q=user/register 2015-12-28 18:32
0 0 xxx.52.208.224 /?q=node/add 2015-12-28 18:32
0 0 xxx.52.208.224 /content/spinach-spinach-and-spinach 2015-12-28 18:32
0 0 xx.94.10.97 /user 2015-12-28 18:28
0 0 xx.94.10.97 /?q=user 2015-12-28 18:28
0 0 xx.94.10.97 /user/register 2015-12-28 18:28
0 0 xx.94.10.97 /user/register 2015-12-28 18:28
0 0 xx.94.10.97 /?q=node/add 2015-12-28 18:28
0 0 xx.94.10.97 /node/add 2015-12-28 18:28
0 0 xx.94.10.97 /content/spinach-spinach-and-spinach 2015-12-28 18:28
0 0 xxx.144.227.34 /user 2015-12-28 18:28
0 0 xxx.144.227.34 /user 2015-12-28 18:28
0 0 xxx.144.227.34 /?q=user 2015-12-28 18:28
0 0 xxx.144.227.34 /user/register 2015-12-28 18:28
0 0 xxx.217.171.178 /content/spinach-spinach-and-spinach 2015-12-28 18:28
0 0 xxx.3.242.250 /user 2015-12-28 18:27
0 0 xxx.3.242.250 /user 2015-12-28 18:27
0 0 xxx.3.242.250 /?q=user 2015-12-28 18:27
0 0 xxx.3.242.250 /user/register 2015-12-28 18:27
0 0 xxx.3.83.153 /?q=user 2015-12-28 18:27
0 0 xxx.3.83.153 /user/register 2015-12-28 18:27
0 0 xxx.217.171.178 /content/spinach-spinach-and-spinach 2015-12-28 18:25
0 0 xxx.214.9.179 / 2015-12-28 18:25
0 0 xxx.214.9.179 / 2015-12-28 18:25
0 0 xxx.214.9.179 / 2015-12-28 18:25
0 0 xxx.217.171.178 /content/spinach-spinach-and-spinach 2015-12-28 18:24
0 0 xxx.217.171.178 /content/spinach-spinach-and-spinach 2015-12-28 18:23
0 0 xxx.217.171.178 /content/spinach-spinach-and-spinach 2015-12-28 18:22
0 0 xxx.77.245.222 /user 2015-12-28 18:20
0 0 xxx.77.245.222 /?q=user 2015-12-28 18:20
0 0 xxx.77.245.222 /user/register 2015-12-28 18:20
Tag: 
Drupal Planet

Comments

This seems to be Drupal's

Youkho replied on
This seems to be Drupal's biggest issue, happened to all the sites i've made.

@Youkho, this isn't just

openventure replied on
@Youkho, this isn't just unique to Drupal sites but any websites in general. You can use https://www.drupal.org/project/antibot and https://www.drupal.org/project/honeypot Both are very lightweight modules.

While this is not unique to

youkho replied on
While this is not unique to Drupal... it seems to me (can be wrong) is one of the most vulnerable. i will try using honeypot. Thanks a lot

honeypot

Walt Daniels replied on
is good at preventing bogus form fill outs, but doesn't stop visits.

Update the Ip Block List

Bill Wu replied on
I was thinking about adding a new function to HUMAN:https://www.drupal.org/project/human module. So, bots' IP will get into the IP address block list automatically. admin/config/people/ip-blocking

40 min is nothing

Christoph replied on
Bot traffic on your website is highly variable, with massive peaks and periods of near silence. You should look at your analysis regularly nd over longer time periods to draw broader conclusions. At work I detect bots, both good and bad, and some in between, all the time and block IP addresses at the firewall or web server level if I determine we don't want to allow the bot into our servers.

Thank you

Al Saleh replied on
Interesting modules. I installed these modules on my site http://www.alayham.com I would certainly like it if the human module blocked robot IPs automatically. Thank you for the effort

Project Honeypot

Paul Querol replied on
If you're thinking of blocking some of these IP addresses (which I'd recommend doing in your server configuration eg. the .htaccess file) then it's often a good idea to check to try to get a fix on whether the IP's are known to often be used by attackers. Try running the most common incoming ip addresses through the search at https://www.projecthoneypot.org/search_ip.php (nothing to do with the honeypot module by the way). In many cases it will tell you if malicious activity has been seen from that IP and can also help to identify "good" traffic such as search engine spiders.

Add new comment

Target Image