Suspicious activity from "Unisys NZ, IT Outsourcer" routing through Pennsylvania?

Forums › IT Pro and developers › Suspicious activity from "Unisys NZ, IT Outsourcer" routing through Pennsylvania?

jamesmcd

62 posts

Master Geek

#204398 29-Sep-2016 19:43

Hey guys,

I use Mouseflow to record sessions on my company's website, and for the last five days I'm seeing fairly long sessions with very strange browsing behaviour from the ISP "Unisys NZ, IT Outsourcer", which I guess is some sort of private company WAN to the HQ in Blue Bell, Pennsylvania.

Further, the visits are a mix of direct, google.co.nz, and google.co.in.

IP addresses include 129.223.113.69, 129.223.113.35, and 129.223.113.53.

I'm guessing this person is indeed in NZ?

The recorded activity on the site seems quite suspicious to me, but I guess that's another matter.

Cheers,

James

freitasm

BDFL - Memuneh
79263 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#1642909 29-Sep-2016 19:57

What is "strange" about it? What makes those sessions strange?

Unisys is indeed a US company with subsidiaries around the world, including New Zealand. I should know, as I worked at Unisys Brasil from 1989 and at Unisys New Zealand from 1997 until 2005.

davidcole

6034 posts

Uber Geek

Trusted

#1642926 29-Sep-2016 20:51

Wouldn't they most likely have a US proxy as their end point for their staff?

Previously known as psycik

Home Assistant: Gigabyte AMD A8 Brix, Home Assistant with Aeotech ZWave Controller, Raspberry PI, Wemos D1 Mini, Zwave, Shelly Humidity and Temperature sensors
Media:Chromecast v2, ATV4 4k, ATV4, HDHomeRun Dual
Server Host Plex Server 3x3TB, 4x4TB using MergerFS, Samsung 850 evo 512 GB SSD, Proxmox Server with 1xW10, 2xUbuntu 22.04 LTS, Backblaze Backups, usenetprime.com fastmail.com Sharesies Trakt.TV Sharesight

jamesmcd

62 posts

Master Geek

#1642934 29-Sep-2016 21:07

davidcole: Wouldn't they most likely have a US proxy as their end point for their staff?

Yeah, I'm guessing it's just an employee here in NZ. In terms of browsing behaviour, they keep clicking between the same three pages (home, about, contact) for 20-30 minutes at a time, and they have done this each day for several days now. It's very different to any "standard" behaviour I review.

davidcole

6034 posts

Uber Geek

Trusted

#1642955 29-Sep-2016 21:26

Ahh I see. Yeah does sound odd.

gzt

17111 posts

Uber Geek

Lifetime subscriber

#1642965 29-Sep-2016 21:45

It kind of sounds like someone is testing a script and has randomly chosen your site, or maybe there is some association between Unisys and the company you work for. Could also be some kind of site or path performance assessment for unrelated reasons.

Alternatively someone just name-dropped your company in a presentation at Unisys and you are seeing a mix of Google searches and direct clicks from an intranet page.

Either way you may find they are responsive to an enquiry on a network maintenance basis if this is having an adverse effect.

vulcannz

436 posts

Ultimate Geek
Inactive user

#1643740 1-Oct-2016 12:20

It's probably just a robot, and Unisys is hosting the local POP for whomever it is.

I'd really be looking at your firewall/IPS data if I were concerned.