Amazon AWS 'bot' traffic? any idea what this traffic is and should i just block it?

[Russellaga]

My website appears to be under seige from 3 Amazon AWS data centres

Ashburn, Virginia USA
Hessen, Germany
Dublin, Ireland

Although i only noticed in early March of this year it appears to have started from these 3 locations when our PPC campaign really started kicking in in late September 2020

Upon discovery via Google Analytics, these 3 locations accounted for approx 45% of all traffic on my site (site visitors per month approx 96k - each one of these3 locations were accounting for around 13-14k per month each - pretty evenly)
It was coming through as paid traffic with 0% income - obviously this freaked me out upon discovering it but i am being assured by our PPC ppl that this is not the case (Im skeptical but keeping an open mind)


The traffic is all the same, near 99-100% bounce rate and averaging 1-1.01 page views

I cannot Imagine there is a legitimate reason for this traffic, I've isolated 2 IP addresses from the Ashburn site but not sure if posting them on here is ok
My website is built and hosted by a third party and so i dont have direct access to server logs - but they sent me a snap shot of part of this morning and the last 7 days
there are legit bots from Google, bing, Ahrefs, moz etc in the list - but im not aware of an amazon bot, and there is it has no business on my site that i can think of

to give you an idea
the two ip addresses 99203 & 94308 hits in the past 7 days
nearly 193k hits in 1 week

can anyone shed any light on why this might be happening?

Russell

 

[EngagementRingsUSA]

In my experience, all traffic from AWS is malicious. The activity ranges from port scans to looking for vulnerabilities, probing login screens, etc...

 

[Russellaga]

Russellaga

this amount of traffic though? between the three data centres it accounted for originally when i first saw it 45% and has climbed to 52% last time i checked

 

[EngagementRingsUSA]

EngagementRingsUSA

What exactly is this traffic doing? Have you reviewed your logs?

 

[castordor]

Is it paid traffic from google adwords? if yes then try to disable google search partners and google display network. Owners of websites are often clicking on the links of their own websites to make money.

 

[Russellaga]

Russellaga

we do have click fraud software running, i would think that it was halt it if that were the case, as i said, whilst i remain openminded if a little suspicious my PPC ppl have assured me its not actually paid for traffic we get 450-650% Roas on ad spend so difficult to see if 45-52% of it was rubbish traffic how we could maintain that Roas

 

[panda]

Sounds like a competitor maybe. Ask your hosting company to block the IP addresses

 

[Rob Whisonant]

AWS is very popular with people using click bots to sell fake traffic. It's also popular to use AWS for hacking scripts. I would just block all traffic from all AWS IP addresses.