Wikistats traffic scripts that parse squid logs can't handle secure messages. Up till early 2015 only 1 or 2 percent of message was secure, so this did not influence breakdown of traffic per country/region that much.

Since June 2015 almost all traffic is secure. The transition happened earlier for traffic from Russia, so percentual traffic from there dropped.

There are theoretically three solutions:

1. Collect the orignal ip address from the x_forwarded_for field. However the geoiplogtag tool (C) by Mark Bergsma can't do that. Direct lookup in MaxMInd DB from perl is very costly, even for 1:1000 sampled log. Extending geoiplogtag would be complicated and possible maintenance prone in, where all other logic for traffic analysis resides in hadoop environment.

2. As squid logs are already produced from hadoop and the country lookup already happens there, upgrading the squid log format by appending the country code as an extra field would be much easier and faster.

3. An alternative solution would be to do away with direct parsing of squid logs and generating the intermediate csv files for all Wikistats traffic reports directly from hive.