# Traffic to 404 pages creating new anonymous contact users **URL:** \ **Category:** Product Support\ **Created:** [May 13, 2021, 5:21pm UTC](https://forum.mautic.org/t/traffic-to-404-pages-creating-new-anonymous-contact-users/19452 "2021-05-13T17:21:34Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![nextafter-dan](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/nextafter-dan/32/5176_2.png) [@nextafter-dan](https://forum.mautic.org/u/nextafter-dan)\ **Post date:** [May 13, 2021, 5:21pm UTC](https://forum.mautic.org/t/traffic-to-404-pages-creating-new-anonymous-contact-users/19452/1 "2021-05-13T17:21:34Z")
**Your software** My Mautic version is: 3.3.3 My PHP version is: 7.4.3 My Database type and version is: MySQL 8 **Your problem** My problem is: I have a brand new install and fresh database. Within a day of the setup I started noticing new contacts being added as if the system was hacked. Tracing back through the Apache access logs I can see external IP addresses hitting all sorts of various endpoints. Each time one hits a page that doesn’t exist it does show the 404 page AND returns the 404 status code, but a new contact gets created anyway. It appears that even GooleImageProxy is creating new contacts. This setup is known only to me and no tracking has been installed on any site. These errors are showing in the log: Apache Access Log: ![Screen Shot 2021-05-13 at 12.09.44 PM](https://us1.discourse-cdn.com/flex020/uploads/mautic/original/2X/7/74d69d8599700ed1549e3c4458ba349ca2bf9d1d.png) Mautic Contact: ![Screen Shot 2021-05-13 at 12.10.21 PM](https://us1.discourse-cdn.com/flex020/uploads/mautic/original/2X/1/19d53a24a51080ca1a68d10e438cc93482d6ab4d.png) GoogleImageProxy: ![Screen Shot 2021-05-13 at 12.17.25 PM](https://us1.discourse-cdn.com/flex020/uploads/mautic/original/2X/8/8c436348e9df1bad3d1489032053ed73e7a641d1.png) ![Screen Shot 2021-05-13 at 12.19.00 PM](https://us1.discourse-cdn.com/flex020/uploads/mautic/original/2X/3/33f30885ee3a3bca6760721935e896270c9e4fda.png) Is this a known issue? Is there a way to restrict these incoming by hostname? or just turn off lead creation unless it’s created via the pixel? Interested in your thoughts. ---
**Author:** ![ekke](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/ekke/32/296_2.png) [@ekke](https://forum.mautic.org/u/ekke)\ **Post date:** [May 14, 2021, 8:39am UTC](https://forum.mautic.org/t/traffic-to-404-pages-creating-new-anonymous-contact-users/19452/2 "2021-05-14T08:39:10Z")
Hi Dan, This is the expected behavior - bots create traffic and that is indeed taken is a new contact with every URL they try (since obviously they do not do cookies). Would be great if Mautic would ignore them if they go 404, but that is not the case as of today. Definitely a feature request. However, the same applies to crawlers of all sorts, except that they don’t have the 404. In other words: Good practice is to create a simple clean-up campaign like “delete all contacts with just one click in 24 hours, and with no email address present”) That should help you get rid of the junk. Greets, Ekke * * * Ekke Guembel **Mautic Open Source Project, Team Lead "Community"** Mail: [ekke.guembel@mautic.org](mailto:ekke.guembel@mautic.org) Phone: +49 511 6262 9311 Profile & Social Media: [Leuchtfeuer.com/ekke](http://Leuchtfeuer.com/ekke) Mautic Podcast: [mauticast.de](http://mauticast.de) (DE) / [mauticast.com](http://mauticast.com) (EN) ---
**Author:** ![nextafter-dan](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/nextafter-dan/32/5176_2.png) [@nextafter-dan](https://forum.mautic.org/u/nextafter-dan)\ **Post date:** [May 14, 2021, 2:45pm UTC](https://forum.mautic.org/t/traffic-to-404-pages-creating-new-anonymous-contact-users/19452/3 "2021-05-14T14:45:30Z")
That’s really unfortunate. It seems like it’s almost inviting an attack that aims to fill up Mautic with a ton of requests and crap data, IMO. I’m personally not really worried about having the anonymous contacts around, but I think it over inflates reporting and adds unnecessary load to the application and database. I guess you could make the case that’s it’s negligible, but it’s worth mentioning. From a product standpoint, it seems that the focus should be on designated “areas” of Mautic that allow those anonymous contacts to be created like Landing Pages, pages with the Tracking Pixel, etc. It would seem to me that external traffic trying to access the actual Mautic instance should only be whichever people or teams trying to use Mautic. I say all that with the caveat that I’m still relatively new to Mautic, so there is probably some area that I’m not aware of yet. ---
**Author:** ![ekke](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/ekke/32/296_2.png) [@ekke](https://forum.mautic.org/u/ekke)\ **Post date:** [June 3, 2021, 5:20am UTC](https://forum.mautic.org/t/traffic-to-404-pages-creating-new-anonymous-contact-users/19452/4 "2021-06-03T05:20:28Z")
Enhancement is on its way, let’s hope it will find its way into Mautic eventually: [https://github.com/mautic/mautic/pull/7614](https://github.com/mautic/mautic/pull/7614)