Phantom referrals

Surge in traffic that isn't real traffic

[hunderdown]

I've done a search and couldn't find this discussed elsewhere. Please just give me a link to a discussion if it has been:

A couple of weeks ago, I started seeing a big increase in traffic. Looked great but when I poked around in the Urchin reports that my host provides, I quickly discovered that it was ALL coming to my home page and leaving immediately. The numbers, admittedly, are not huge. I usually get 1,000 visits/day or so to my home page, with other pages on my site also getting incoming traffic (but they got none of this new traffic).

Stranger still, the domains of the visitors were all .mx, .br, .pe, .ar, .pl, and the like. And my site is English language. (Please let me know if it's OK to do so, and I'll post the most common domains) Urchin was reporting all of these as "no referral"--which are type-ins or bookmarks, right?

Pretty soon my reported visits were double what they usually are, and climbing. I signed up for Google Analytics in the hope that it would tell me something that Urchin didn't. And it did. It doesn't include search engine bots in its statistic reports, and it didn't include these visits either.

What's going on? And should I be concerned? I think it may be some kind of prank, but i don't know. It's not a big problem now, justt mysterious. The phantom visits have more or less leveled off (at about triple of normal) but if they start to go up again they could lead to extra charges from my host.

Thanks for any ideas....

[chewy]

I'm seeing an increase in visitors and an according drop in page views per visitor.

It took me a while to figure this out - my best guess now is this is a lot of 'hits' from visitors who have posted some of our images on their myspace or other type pages.

[Staffa]

By chance, did you sign up with any of these services that promise you xthousand visitors for a few $ because it seems to be pretty much that, ie a bot instead of the promised visitor hitting your site.

[topr8]

Urchin was reporting all of these as "no referral"--which are type-ins or bookmarks, right?

wrong! : :)

no referral more often (imo) means either:

a legitamate user with 'referrer' turned off (easy and commonly done with some browsers)

or:

more often, a spider/scraper/ that your stats package does not recognise as a scraper/spider/bot etc

- not sure this helps you in this case seeing as the hits all seem to be to your home page, but thought i'd at least clear one point up.

[hunderdown]

By chance, did you sign up with any of these services that promise you xthousand visitors for a few $ because it seems to be pretty much that, ie a bot instead of the promised visitor hitting your site.

Staffa, absolutely not. I should have mentioned that my site (which you can find in my profile) has been around for more than ten years, is respected in its niche, and usually receives a stable mix of visitors from search engines and links, with a good number of return visitors. I have never attempted to buy traffic. However, it's certainly possible that someone signed me up for something like that as a prank.

topr8, thanks, not sure that applies. My visitors are mostly not savvy enough to do something like turn off "referrer."

In this case, as I said, though these visits are reported as "no referrer" they are also reported as coming from certain domains, almost entirely from Latin America, which I don't recognize as search engine bots. Perhaps they are scrapers, but then why are they only hitting the home page? Here are the three most common of them: prod-infinitum.com.mx, adsl.tpnet.pl, and speedy.net.pe. I've never noticed these in my logs before, and all of a sudden they are in the top ten referring domains reported as sources of visitors. (Mods, apologies in advance if that information shouldn't be posted here, but it seems relevant to the discussion and too non-specific to out or promote someone...)

[zCat]

I've been noticing sudden spates of concurrent hits in my logs which appear to come from a dozen or more PCs from around the world; the IPs mostly trace back to residential dialup domains (which look similar to those you cite above). I'm guessing they're PCs which have been hijacked by some virus or something and which are being used for some nefarious purpose (scanning for email addresses, content scraping, vulnerability scans etc.). Apart from messing up the stats a little they don't seem to do any harm though.

[hunderdown]

Thanks, zcat and others. I'm starting to think that this can't be a big deal since no one had anything really scary to say about it.

Just another weird Web thing.