homepage Welcome to WebmasterWorld Guest from
register, free tools, login, search, pro membership, help, library, announcements, recent posts, open posts,
Become a Pro Member

Home / Forums Index / WebmasterWorld / Website Analytics - Tracking and Logging
Forum Library, Charter, Moderators: Receptional & mademetop

Website Analytics - Tracking and Logging Forum

This 354 message thread spans 12 pages: < < 354 ( 1 2 3 4 5 6 7 8 9 [10] 11 12 > >     
Logs Show Surge, but Not Human?

 9:23 pm on Feb 21, 2012 (gmt 0)

On one site I work with, I've seen traffic go from 10K visits/day to 40K. The additional traffic looks human at first glance - it is captured by Google Analytics, It comes from diverse consumer IPs in the US and Europe (but not Asia), and the bounce rate is high but one out of ten visits or so loads another page.

On the non-human side, we have all of the traffic coming with no referrer, and it is all focused on a few pages that are hardly viral linkbait and would get one or two views on a good day. It's all IE (spread among 6 - 9), and a range of screen resolutions that look unusually aged (e.g., 1024x768).

Anecdotally, I've heard of a few other sites seeing this kind of traffic, but nobody knows what the purpose might be. It's not scraping, as it's the same pages that get hit. It's not intense enough to be an attack to take the site down, nor is the site likely to be the target of miscreants.

The level of traffic has gone up and down, but it's still happening.

Are any of your sites seeing this, and do you have any theories?

Any thoughts on screening this out of Analytics? It totally blows up time period comparisons.



 1:16 pm on Apr 20, 2012 (gmt 0)

Reading here it looks like some folks are being abandoned by this botnet and others are getting their traffic. Iím getting the new traffic, so I have implemented a new strategy and can report some serious progress as I estimate that I am blocking 90% or more of this thing.

For the first time ever, Iím not going to report details on what exactly Iím doing (unless they go away forever). I apologize for my shut mouth policy on this issue and hope folks continue to share as much as they can on these forums.

So, with that said, this thing can be shutdown with a little creativity, access configuration tricks and effort.


 2:11 pm on Apr 20, 2012 (gmt 0)

Mine's down even further. (I can tell that it's down, Mario155, because this site gets very little direct traffic yet, mostly search engine, and it's targeted to one particularly state, and the direct traffic is coming mostly from Europe and other states)

Goofiest thing I've seen in a while. I got no explanation. No, I never heard anything from Google after I gave them a few sites to look at (but I didn't really expect I would) There's nobody to report it to, because there's nobody in charge of such things, nor any clear way to trace it back. I'd just take your ads off the affected pages, and keep going, if you can.

If it's actually *CLICKING* on ads, then it's a different thing than what I've had.


 4:23 pm on Apr 21, 2012 (gmt 0)

For anyone using Wordpress, have you tried faketrafficblaster.com plugin yet? If yes, how is your experience?

We don't use WP for the attacked site. However, tried their cookie testing, it seems block #*$! visits, but it's just too small, comparing to 60K daily visits I currently have. I wonder if I did anything wrong, but I want to check the real experience first, to know if that solution is working



 12:41 pm on Apr 23, 2012 (gmt 0)

On the page that I removed AdSense from completely, the bots have finally stopped visiting it this week. However they are still on a second page of my site that they were visiting much more anyway. I think I might remove AdSense from the 2nd page that they are visiting and see what happens.


 1:30 pm on Apr 23, 2012 (gmt 0)

does anyone changeed the IP Adress?
Follow the bot to the new IP Adress?


 3:57 am on Apr 24, 2012 (gmt 0)

Change IP of website? I don't think it helps. Bots visit domain, not ip.


 9:06 am on Apr 24, 2012 (gmt 0)

Can you all say what topics have your affected websites? My website has the topic of SEO.

Sometimes I think it is an bot to analyse which Position the Ad's in Adsense has...


 9:45 am on Apr 24, 2012 (gmt 0)

My website has nothing to do with SEO and the hits are back up to the previous levels of 21st :(


 12:58 pm on Apr 24, 2012 (gmt 0)

My traffic is also back to as high as it was on 2/21. I have a feeling that this is affecting my ad revenue in general because I am not making as much as I used to from the evening hours till the end of the day cutoff, which is midnight Pacific time. It could possibly be affecting traffic if too many of these bots are on the site at once and slowing it down.

I am considering blocking access of IE9 to my site.


 1:09 pm on Apr 24, 2012 (gmt 0)

>>I am considering blocking access of IE9 to my site.

That's pretty extreme, Mario, but I totally get your level of frustration.

It would be great if Google or Microsoft could get involved - we have members who are turning off their products because of this attack. Furthermore, the value of Google Analytics is destroyed by this bogus traffic since there's no filter in GA that can screen it out and the infected machines are hitting the same pages the real users do.


 2:04 pm on Apr 24, 2012 (gmt 0)

Right, but when you think about it - what could they do?

I'm not even 100% positive it's illegal, at least maybe not in every country.


 2:22 pm on Apr 24, 2012 (gmt 0)

Dropped waay down on 19th - averaging 200 visits per day now to the affected page - which is almost back to normal.

Let's hope it stays that way!


 2:27 pm on Apr 24, 2012 (gmt 0)

One of our sites is still increasing, up to 35K+ yesterday. Another site dropped from 61K to 38K yesterday. Still finding out solution for this


 2:37 pm on Apr 24, 2012 (gmt 0)

It is totally screwing up my web stats. I have no idea how many people are really visiting my site now. I agree that it would be nice for Google to get more involved with this. I think they actually have because looking at my AdSense stats now, they are automatically not paying me for any clicks when the user goes to mysite.com without the www at the front. Remember before I said that a lot of the bots were not using the www at the beginning of the domain.

It is interesting to see that AdSense is blocking that revenue now, instead of later when they do the final month payout. But I still wonder if they are blocking valid clicks, I still think my revenue is lower than it should, and unfortunately I have no idea if my traffic is down this month since I don't have a clue of how many visitors I really have on my site.

I am just thankful that the bots have never went past 10k a day for me. If they do get as high as 60k like other people I am blocking IE9 for sure.


 3:11 pm on Apr 24, 2012 (gmt 0)

I would still absolutely recommend not running AdSense on pages hit by this type of traffic. Google has a shoot first, ask no questions policy.

If you continue to do so, it's at your own risk.


 4:48 pm on Apr 24, 2012 (gmt 0)

Seems like a first step would be to determine what's causing this. Something is turning machines into elements in a botnet. If it's malware, it may be tough to directly impact. If it's some kind of user-installed software (like Gomez), then at least we have a legal target to go after.


 4:53 pm on Apr 24, 2012 (gmt 0)

The target page (my homepage) traffic levels on my site are pretty much down to pre-attack levels and have been for a few days now.

Hope it holds.


 5:18 pm on Apr 24, 2012 (gmt 0)


The problem is that I already removed AdSense from the page that the bots were visiting. The ads I replaced them with were paying hardly anything so I lost money. Then the bots transferred over to another popular page on my site.

The page they are on now does not appear to be getting a lot of ad clicks, and it is really not making a whole lot of revenue. I am getting sick of being held hostage by these things and having to remove Ads. The way my site is laid out, if I remove the ads completely it will have open spaces and look dumb.

I am wondering if these bots are attracted to AdSense or something.


 5:27 pm on Apr 24, 2012 (gmt 0)

I understand the problem, Mario155, believe me. I wish there were a solution.


 12:58 am on Apr 25, 2012 (gmt 0)

We see these spikes too. Log based analytical are more accurate and seem to ignore these spikes.


 6:20 pm on Apr 26, 2012 (gmt 0)

Interesting and weird coincidence; the bot traffic stopped the day of the latest Panda refresh. I'm sure it's a coincidence, but ... weird.


 11:24 pm on Apr 27, 2012 (gmt 0)

It hasn't stopped for me. It is actually getting higher and higher each day.


 3:24 pm on May 1, 2012 (gmt 0)

the bot traffic stopped the day of the latest Panda refresh

Has anyone discussed/evaluated whether "position in the SERPs" has any connection with drawing or sustaining the bot's attention?

Is everyone prepared to say "this is totally random" or how far has the discussion come in identifying commonality?

Perhaps this is a test of a service? In other words, the botoperator is running a test to see what sites it can/may knock down (verticals, link profiles, etc.) AND THEN will offer "its service" to others?

Given the dearth of explanations of a rational for this "attack" it almost makes sense that it would be a trial run of a page-site/knock-down-service . . unless, of course, it truly is a bot gone rogue, i.e., a bot without a mission . . :-/


 3:43 pm on May 1, 2012 (gmt 0)

Has anyone discussed/evaluated whether "position in the SERPs" has any connection with drawing or sustaining the bot's attention?

Yes, the four original pages this bot pounded on my site all positioned in the serps above the fold at # 4 or better.

It has been my view that this is a Google, Bing or other serp modifiying bot attack.


 3:51 pm on May 1, 2012 (gmt 0)

I can confirm that since the bot a previous #1 google position for over 5 years has fallen to #6 and seems to be going to drop again. Could this be related?


 4:20 pm on May 1, 2012 (gmt 0)

That's an interesting point. And if in that case, "that service" did a good job to hide their information. I really like to know more information about "that vendor"


 4:30 pm on May 1, 2012 (gmt 0)

The "high in the SERPs" could be a red herring. Just about every page ranks for some phrase or other. In my case, the bots seem to be hitting some pages that rank for essentially nothing, generate very little traffic from search. The site home page has some rankings that would be considered desirable.


 2:00 pm on May 2, 2012 (gmt 0)

The page it hit on my site (home page) was ranking on the first page, but not #1 for many terms. As far as I can tell, the rankings never changed. But the site is seasonal, and it was off season, so it wasn't getting much traffic anyway. That's why it stood out so much.

I wondered if this was some kind of test, and if so, did I pass, fail, or what?

Someone on the post on my site responded that they had actually discussed this with an AdSense account rep and were told that AdSense was seeing a lot of this and they were mystified too.

I'm still getting around 20 or 30 visits a day by this. So it hasn't totally gone away.


 6:27 pm on May 2, 2012 (gmt 0)

20 or 30 beats 20K or 30K... :)


 10:54 pm on May 3, 2012 (gmt 0)

I can confirm that the two pages of mine which are the focus of the bot were both extremely high in the SERPS for coveted keywords, and they'd just reached that position shortly before the start of the attack.


 12:59 pm on May 5, 2012 (gmt 0)

I havenít been thinking about this botnet thing as I have shut it down and is totally invisible to my stats, AdSense etc. and my serverís can easily handle the load.

The botnet did start hitting a new webpage, so that brings the count to five webpageís being hit.

I am however, recording the botnetís activity. There was a huge up tick a couple of weeks ago. I started receiving at least 10,000+ page views an hour up from about 1000 and hour.

Then the botnet started to trickle off page views on May 2 at about 6:00pm est.. There was another significant downtick Yesterday (May 4) at about 9:00 am.

I am curious as to what Google thinks of this..

This 354 message thread spans 12 pages: < < 354 ( 1 2 3 4 5 6 7 8 9 [10] 11 12 > >
Global Options:
 top home search open messages active posts  

Home / Forums Index / WebmasterWorld / Website Analytics - Tracking and Logging
rss feed

All trademarks and copyrights held by respective owners. Member comments are owned by the poster.
Home ¦ Free Tools ¦ Terms of Service ¦ Privacy Policy ¦ Report Problem ¦ About ¦ Library ¦ Newsletter
WebmasterWorld is a Developer Shed Community owned by Jim Boykin.
© Webmaster World 1996-2014 all rights reserved