modelman - 12:08 pm on Apr 17, 2013 (gmt 0)
To put that another way, Brokaddr, if I go to "Audience" -> "Network" with keyword as my secondary dimension, my number one result is:
Service Provider/Keyword/visits/pages per V./Duration/New V./bounce
microsoft corp/(not set)/15,327/1.00 /00:00:00/99.99%/99.83%
and if I set the secondary dimension to "Flash Version" I get
microsoft corp/11.4 r402/15,259/1.00 /00:00:00/100.00%/100.00%
2100 of those 15k visits come from Lincoln Nebraska with that Flash version and they are also from msn.com
I can look up "audience" -> "Technology" -> "Browser & OS" and get the same bogus traffic all neatly packed into "Mozilla Compatible Agent"
This led me to think it might be a vulnerability in that particular version of Flash that only worked with mozilla on the msn network...sort of a multiple weak link scenario, but after you've barked up enough wrong trees they all start looking the same.
4300 of those 15k come from Hialeah Florida, same flash version, agent and network, and recently they started coming in from Deerfield Beach, Tampa and Gainesville Florida. There are many more with the location "not set" (5246 bouncers, all with Flash 11.4 r402) but what really spooked me was when I sent out a newsletter that I was going to New Jersey, they started coming from Paterson NJ, only five miles from where I briefly visited. At first I thought it might be me, but it started before I got there and continued after I left. Just a coincidence, I guess.
So I checked my server logs and saw a low level attack against my root ssh and ftp originating from the Republic of North Korea embassy across the street from the United Nations Building in Manhattan. It used two different IP addresses simultaneously. This seemed totally unrelated, but had the same frequency.
Even if the keyword is not set, it brings down the relevance of that page for any keyword. If this is a malicious attack, and not just some poorly behaved code, then the intention is clearly to reduce my organic search traffic. It has certainly done that. Mostly, I just want to know what's causing this.