homepage Welcome to WebmasterWorld Guest from 54.227.12.219
register, free tools, login, search, subscribe, help, library, announcements, recent posts, open posts,
Subscribe to WebmasterWorld
Home / Forums Index / WebmasterWorld / Website Analytics - Tracking and Logging
Forum Library, Charter, Moderators: Receptional & mademetop

Website Analytics - Tracking and Logging Forum

This 354 message thread spans 12 pages: < < 354 ( 1 2 3 4 5 6 7 8 9 10 [11] 12 > >     
Logs Show Surge, but Not Human?
rogerd




msg:4420176
 9:23 pm on Feb 21, 2012 (gmt 0)

On one site I work with, I've seen traffic go from 10K visits/day to 40K. The additional traffic looks human at first glance - it is captured by Google Analytics, It comes from diverse consumer IPs in the US and Europe (but not Asia), and the bounce rate is high but one out of ten visits or so loads another page.

On the non-human side, we have all of the traffic coming with no referrer, and it is all focused on a few pages that are hardly viral linkbait and would get one or two views on a good day. It's all IE (spread among 6 - 9), and a range of screen resolutions that look unusually aged (e.g., 1024x768).

Anecdotally, I've heard of a few other sites seeing this kind of traffic, but nobody knows what the purpose might be. It's not scraping, as it's the same pages that get hit. It's not intense enough to be an attack to take the site down, nor is the site likely to be the target of miscreants.

The level of traffic has gone up and down, but it's still happening.

Are any of your sites seeing this, and do you have any theories?

Any thoughts on screening this out of Analytics? It totally blows up time period comparisons.

 

Edge




msg:4449827
 12:59 pm on May 5, 2012 (gmt 0)

I haven’t been thinking about this botnet thing as I have shut it down and is totally invisible to my stats, AdSense etc. and my server’s can easily handle the load.

The botnet did start hitting a new webpage, so that brings the count to five webpage’s being hit.

I am however, recording the botnet’s activity. There was a huge up tick a couple of weeks ago. I started receiving at least 10,000+ page views an hour up from about 1000 and hour.

Then the botnet started to trickle off page views on May 2 at about 6:00pm est.. There was another significant downtick Yesterday (May 4) at about 9:00 am.

I am curious as to what Google thinks of this..

Edge




msg:4450038
 12:36 pm on May 6, 2012 (gmt 0)

Lessons learned (for me anyway).

I've never been much to experiment with SEO methods and strategies. My philosophy has always been that if there is a really good reason for a visitor to come and keep coming back – they will.

In other words, focus on being helpful, having quality and presenting what the user likely came for.

What this Botnet physically demonstrated to me is that a high bounce rate and a short visit duration (which is what a spammy web site likely has) will affect your AdSense earnings and position within the search engines results.

Webwork




msg:4450065
 3:01 pm on May 6, 2012 (gmt 0)

I am curious as to what Google thinks of this..


What I'm curious about is whether G can "see" if the botoperator is querying the SERPs to a) observe how their bot is affecting sites; b) querying in real-time to study "how many hits/zombie visits" are needed to affect the rankings of various IBL/ranking-factor profiles, etc. Without gathering "effects/ranking data", i.e., what the bot is accomplishing other than harrassing sites, considerable "value of the experiment" would be lost. (Again, this assumes the test is a test of a potential knockdown service/bot.)

I imagine, if the monetization model is a knockdown service, that the botoperator needs a lot of data to determine pricing, etc. That data would involve "observing/querying" the relevant SERPs and aggregating that data both in real time (to tweak inputs) and at the end of "the study". If "the service" will be for a private/criminal network then te data would be more for strategic deployment purposes.

I was also wondering if "this system" could be used "to tweak" Google's content network PPC pricing algo/smartpricing". If a well structured bot could affect G's PPC, by artificially lowering/raising bids on the content network, then I imagine that ability could be financially exploited.

hottrout




msg:4450910
 4:34 pm on May 8, 2012 (gmt 0)

Well I have just had my site PR drop from 5 to 4 today and I can only think that this is related to these attacks.

Does anyone have any clue how to stop this?

netmeg




msg:4451301
 1:55 pm on May 9, 2012 (gmt 0)

No, that's not related to the attacks. PR is about links. Either you lost some links, or possibly some of the links you still have were devalued a bit. The bots can't affect PageRank.

Archbob




msg:4452064
 2:20 am on May 11, 2012 (gmt 0)

I've been having this issue for 2 months or more now. I noticed that it doesn't effect PPC or SERPS on my site, it just makes my bounce rate look really high which is very annoying.

Archbob




msg:4452066
 2:23 am on May 11, 2012 (gmt 0)

I got a response from Gomez saying my URLs are not in their system but I don't believe them. The traffic matches their software nicely. Only MSIE. Mostly from Tier-1 countries. Loads javascript and many webmaster reported an increase around the time Gomez was launched. Too many signals pointing to them to be ignored.

hottrout




msg:4452220
 1:28 pm on May 11, 2012 (gmt 0)

What is gomez? Can you provide more info about it please.

twitch




msg:4452273
 4:37 pm on May 11, 2012 (gmt 0)

Do you mean [gomez.com...] I Never signed up there.

Mario155




msg:4454340
 10:46 pm on May 16, 2012 (gmt 0)

I am getting a few thousand links coming in from your.schoolfeed.com and bingo.schoolfeed.com

I am not sure if that site is related to this attack. It should be noted that these links do not show up in Google Analytics, but they do show in my web logs which I download and view in a different program.

School Feed appears to be a facebook or classmates.com ripoff website. The referring links just go to a generic page of their site, so I assume I need to be signed up and/or on someone's friend list to view how my site was linked to them.

I am wondering if they have some sort of spambot thing going on, because I don't see how I would get thousands of links from that site when I get much less from Facebook, which is a much larger site.

hottrout




msg:4456863
 9:02 am on May 23, 2012 (gmt 0)

This weird traffic remains constant and has now been corrupting the google stats for three months. It has made a nonsense of my analytics and is a major pain.

Has anyone had any ideas on how to prevent this or does anyone have a solution to the problem?

A lot of people have this issue so I cant understand why nothing has been done or why google has had nothing to say!

twitch




msg:4457726
 8:56 am on May 25, 2012 (gmt 0)

hey hottrout, there is no solutions for that dump stuff at the moment.

hottrout




msg:4457727
 9:03 am on May 25, 2012 (gmt 0)

I know but it seems hard to believe. So many people are being so badly effected that you would imagine Google must be aware of it?

Shatner




msg:4458680
 5:25 pm on May 28, 2012 (gmt 0)

Update on this... this morning they upped their efforts on me and started hitting new pages.

This time I was able to track the referral address, it's coming from here...

[108.166.83.225...]

The company is named Adssourcing, Inc. It's from Bangladesh. I have no idea how to stop it or how they're doing it though.

Any thoughts?

Shatner




msg:4458684
 5:34 pm on May 28, 2012 (gmt 0)

There's a note on their site that they recently moved servers, I wonder if that's why I'm able to see the referrer now wheras in the past it was coming through as direct traffic all the time?

macavity




msg:4458716
 6:56 pm on May 28, 2012 (gmt 0)

Hi Shatner,

Are you still seeing the direct traffic in addition to this new wave or did the direct traffic drop at the same time this appeared? I'm not seeing 108.166.83.225 in my logs - could this be a separate issue?

Shatner




msg:4458722
 7:20 pm on May 28, 2012 (gmt 0)

@macavity

Yeah actually now I'm wondering if this is a separate thing, because I'm still seeing the direct traffic in ADDITION to this.

Also while ALL of this traffic comes from Bangladesh, the direct traffic is from all over the geo.

macavity




msg:4458731
 7:51 pm on May 28, 2012 (gmt 0)

OK, thanks (my direct traffic is from US/Canada).

Igal Zeifman




msg:4458927
 9:58 am on May 29, 2012 (gmt 0)

Recently our company released a a study that show that on average 50% of your site traffic is just bots (some very bad ones - scanners/spammers/scouts). For small sites 2500 visitors/month the numbers can be as high as 80%...

But... usually such bots are not shown by GA since they do not activate JavaScript.

I think you might be dealing with botnet DDos attack.

Seb7




msg:4458964
 11:21 am on May 29, 2012 (gmt 0)

Yep, my stats have been showing more bots than humans for at-least the last three years. Igal is correct, you cant tell this by using GA.

Staffa




msg:4458980
 12:34 pm on May 29, 2012 (gmt 0)

I agree with Igal and Seb7, I have been bot hunting for the past 10 years (it's a sport) and the number of IP ranges that I have now blocked is mindboggling.

netmeg




msg:4460470
 6:03 pm on Jun 1, 2012 (gmt 0)

This particular attack had specific markers, and not like some of the things being reported here.

They were all MSIE

Various forms of Windows.

All direct traffic (no referrer)

Usually just hit from 1-4 pages on a site (in my case, it only ever hit the home page)

From all over the world.

Executed javascript.

Anything else is a different kind of bot (and yes, there are lots)

Google hasn't said anything because most likely there's nothing they can do. They're not causing, and there's no reason to think they can stop it. This traffic looks exactly like human type browser traffic. I personally am still of the opinion it's some kind of a malware thing.

Mine stopped on April 19, and as far as I know, it's not still going on - but at this point, I have too much normal traffic on that site to notice (unless it was REALLY huge) But some other people are still seeing it.

I've seen some interesting visitors to the blog post about it on my site, including some big ISPs and the Dept of Defense. So maybe some others are starting to take notice.

But ultimately, I don't think there's any point in waiting for a solution, because right now, there's none on the horizon.

justawriter




msg:4460545
 7:47 pm on Jun 1, 2012 (gmt 0)

Is Roger still getting hit with this traffic?

Archbob




msg:4460766
 4:01 pm on Jun 2, 2012 (gmt 0)

Does anyone know how to show an ad or load a page only if you detect mouse movement or mouse clicks?

netmeg




msg:4461219
 1:48 pm on Jun 4, 2012 (gmt 0)

We talked about it, but I never did exactly figure out how to do it.

Last I heard, Roger was still getting hit but I haven't talked to him about it recently. Next time I see him on twitter I'll ask.

brotherhood of LAN




msg:4461221
 1:57 pm on Jun 4, 2012 (gmt 0)

>Does anyone know how to show an ad or load a page only if you detect mouse movement or mouse clicks?

Those can be replicated just as easy. Going by netmeg's explanation of the visits, they would appear to be browsers rather than command line clients.

You should be able to get a mouse pointers position within a browser window using javascript though.

IMO, check that these are indeed IE browsers by executing some javascript only IE would understand... if you catch it out then that's a pretty big flag you can work with.

rogerd




msg:4461305
 5:37 pm on Jun 4, 2012 (gmt 0)

Unfortunately, my bot traffic actually increased in mid-April and remains at a high level.

Archbob




msg:4461519
 8:03 am on Jun 5, 2012 (gmt 0)

Has anyone found out what kind of malware is causing this traffic? It seems that they are getting more nodes

Archbob




msg:4461521
 8:19 am on Jun 5, 2012 (gmt 0)

Its completely IE that these bots are using.

anallawalla




msg:4467463
 5:23 am on Jun 20, 2012 (gmt 0)

Just about every page ranks for some phrase or other. In my case, the bots seem to be hitting some pages that rank for essentially nothing, generate very little traffic from search.


If this botnet is testing a Negative SEO offering, then they ought to test on an obscure phrase that is not competitive, because such a SERP will not have a lot of variables, e.g. regular competitive SEO activity.

Archbob




msg:4468224
 4:21 am on Jun 22, 2012 (gmt 0)

Now I have traffic that triggers adsense(as well as my other ads) but not analytics. WTH?

This 354 message thread spans 12 pages: < < 354 ( 1 2 3 4 5 6 7 8 9 10 [11] 12 > >
Global Options:
 top home search open messages active posts  
 

Home / Forums Index / WebmasterWorld / Website Analytics - Tracking and Logging
rss feed

All trademarks and copyrights held by respective owners. Member comments are owned by the poster.
Home ¦ Free Tools ¦ Terms of Service ¦ Privacy Policy ¦ Report Problem ¦ About ¦ Library ¦ Newsletter
WebmasterWorld is a Developer Shed Community owned by Jim Boykin.
© Webmaster World 1996-2014 all rights reserved