Strange traffic increase in 'Direct Access'. HELP!

weird 75% increase within 1 month!

[Cyclob]

I noticed strange traffic increase in 'Direct Access' category around 75% from site stats since April 28, 2008.

The number start to increase since then until now and still can't find any reason. I will be happy if sales number increase as well but it's not so that is why ROI percentage are starting to drop....more traffic, same amount of sales!

I heard that it's something about the latest Security software update (Norton, Kaspersky, etc..) and it strip out string from users's browser so it will be an "Un-identified" in my log file, and those number were thrown in to 'Direct Access' category.

Anybody heard something like this? Please help...

Thanks in advance.

[Cyclob]

One more thing, almost 90% of my traffic come from Google. Could it be google itself that did not pass referrals correctly to my site, and it cause of those "un-identified" referrals instead of "Google"?

But the number from organic Google to me are still the same, no increase, no dropped.

Please help...

[Mentat]

E-mail support.
My sitution is exactly opposite. 0% direct traffic.

[cgrantski]

This may or may not be relevant. One of our ongoing stats is how many AdWords clicks have no referrer. It has been steady for about 6 months and went up 25% in the last six weeks.

[Samizdata]

I heard that it's something about the latest Security software update

I may be wrong but this sounds like the latest version of Grisoft's AVG antivirus package pre-fetching search results and messing up your stats - the timing is right but the only way to tell for sure is to examine your log files and look for "1813".

[webmasterworld.com...]

[Cyclob]

Thanks Samizdata! I think this could be the possibly reason for those of my un-identified referrals.

So what should we do about this? Seems like we can't block them but t wouldn't be good too if I still let the 'Direct Access' box keep growing their size.

Can we crate another category to thorwn them in instead of Direct access?

[Samizdata]

So what should we do about this?

Assuming your software supports it you could presumably filter the user-agent from the stats.

Bandwidth and security issues are discussed at length in the other threads.

[cgrantski]

Samizdata, that's really helpful and in fact solved a big problem we were having. I guess I need to watch the Spider Identification forum from now on. There's some great information there.

[Cyclob]

Well, Samizdata, can you please explain more of how to filter this user-agent out from the stats?

I'm not a programmer and pretty new about this coding stuff. Filter mean block them? How to do that?

Thanks again.

[ken_b]

I noticed a big jump in "direct" visits too, beging May 20, 2008, a 300% increase, that still goes on according to Google Analytics.

BUT...

When I checked my visits from referring sites, there was a corresponding drop of the about same number in that stat.

[cgrantski]

cyclob, he means to set your analytics program so that it does not count any activity by this user-agent, since it's not real visitor activity.

Blocking it would mean that browsers that have it installed will not get an "all-clear" signal from this link-testing software and may not be able to click on the link without getting a warning. I've never used it so I don't know what happens.

If you use Google Analytics, I think you would set this up as a "Visitor Browser Program" filter.

[Samizdata]

I don't use analysis packages myself but this was posted by ColinG in another thread:

This will have the impact of making all server log analysis programs worthless and making the javascript driven web analytics the only usable tool. Perhaps if you grepped out these agent entries before processing the files you could recover and get proper data.

That was more than a month ago so perhaps an expert in this forum can offer an update.

...

What you are looking for is exact matches for ;1813) in the log files.

This is also what makes AVG such a laughing stock as a "security" company.

...

[edited by: Samizdata at 1:53 pm (utc) on June 11, 2008]

[cgrantski]

I don't get it. Why would server log analysis be worthless? Just filter them out, i.e., have the analysis program ignore them.

As far as I can tell, they pre-fetch but they don't serve a cached page to visitors. If the visitors click on a link that has been examined by these programs, the visitors show up in your logs just as if that other program hadn't done anything.

[Samizdata]

I will add another quote from ColinG from the same post:

This explains why our visitor count using an older analysis program is up 15% month to month and the Google Analytics visitor counts are up just a few percent

The remarks were made a month ago during the initial (and widespread) confusion over AVG, and I would be surprised if the author hasn't found a way to cope with the issue by now. But others are only just encountering it and are naturally baffled.

You have to be able to identify AVG to filter it out.

But being identifiable is what makes it a joke as a security tool.

...