Welcome to WebmasterWorld Guest from 54.166.224.46

Forum Moderators: DixonJones & mademetop

Message Too Old, No Replies

Logs Show Surge, but Not Human?

     
9:23 pm on Feb 21, 2012 (gmt 0)

WebmasterWorld Administrator rogerd is a WebmasterWorld Top Contributor of All Time 10+ Year Member



On one site I work with, I've seen traffic go from 10K visits/day to 40K. The additional traffic looks human at first glance - it is captured by Google Analytics, It comes from diverse consumer IPs in the US and Europe (but not Asia), and the bounce rate is high but one out of ten visits or so loads another page.

On the non-human side, we have all of the traffic coming with no referrer, and it is all focused on a few pages that are hardly viral linkbait and would get one or two views on a good day. It's all IE (spread among 6 - 9), and a range of screen resolutions that look unusually aged (e.g., 1024x768).

Anecdotally, I've heard of a few other sites seeing this kind of traffic, but nobody knows what the purpose might be. It's not scraping, as it's the same pages that get hit. It's not intense enough to be an attack to take the site down, nor is the site likely to be the target of miscreants.

The level of traffic has gone up and down, but it's still happening.

Are any of your sites seeing this, and do you have any theories?

Any thoughts on screening this out of Analytics? It totally blows up time period comparisons.
1:16 pm on Apr 20, 2012 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Reading here it looks like some folks are being abandoned by this botnet and others are getting their traffic. Iím getting the new traffic, so I have implemented a new strategy and can report some serious progress as I estimate that I am blocking 90% or more of this thing.

For the first time ever, Iím not going to report details on what exactly Iím doing (unless they go away forever). I apologize for my shut mouth policy on this issue and hope folks continue to share as much as they can on these forums.

So, with that said, this thing can be shutdown with a little creativity, access configuration tricks and effort.
2:11 pm on Apr 20, 2012 (gmt 0)

WebmasterWorld Senior Member netmeg is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month



Mine's down even further. (I can tell that it's down, Mario155, because this site gets very little direct traffic yet, mostly search engine, and it's targeted to one particularly state, and the direct traffic is coming mostly from Europe and other states)

Goofiest thing I've seen in a while. I got no explanation. No, I never heard anything from Google after I gave them a few sites to look at (but I didn't really expect I would) There's nobody to report it to, because there's nobody in charge of such things, nor any clear way to trace it back. I'd just take your ads off the affected pages, and keep going, if you can.

If it's actually *CLICKING* on ads, then it's a different thing than what I've had.
4:23 pm on Apr 21, 2012 (gmt 0)



For anyone using Wordpress, have you tried faketrafficblaster.com plugin yet? If yes, how is your experience?

We don't use WP for the attacked site. However, tried their cookie testing, it seems block #*$! visits, but it's just too small, comparing to 60K daily visits I currently have. I wonder if I did anything wrong, but I want to check the real experience first, to know if that solution is working

Thanks.
12:41 pm on Apr 23, 2012 (gmt 0)



On the page that I removed AdSense from completely, the bots have finally stopped visiting it this week. However they are still on a second page of my site that they were visiting much more anyway. I think I might remove AdSense from the 2nd page that they are visiting and see what happens.
1:30 pm on Apr 23, 2012 (gmt 0)



does anyone changeed the IP Adress?
Follow the bot to the new IP Adress?
3:57 am on Apr 24, 2012 (gmt 0)



Change IP of website? I don't think it helps. Bots visit domain, not ip.
9:06 am on Apr 24, 2012 (gmt 0)



Can you all say what topics have your affected websites? My website has the topic of SEO.

Sometimes I think it is an bot to analyse which Position the Ad's in Adsense has...
9:45 am on Apr 24, 2012 (gmt 0)

5+ Year Member



My website has nothing to do with SEO and the hits are back up to the previous levels of 21st :(
12:58 pm on Apr 24, 2012 (gmt 0)



My traffic is also back to as high as it was on 2/21. I have a feeling that this is affecting my ad revenue in general because I am not making as much as I used to from the evening hours till the end of the day cutoff, which is midnight Pacific time. It could possibly be affecting traffic if too many of these bots are on the site at once and slowing it down.

I am considering blocking access of IE9 to my site.
1:09 pm on Apr 24, 2012 (gmt 0)

WebmasterWorld Administrator rogerd is a WebmasterWorld Top Contributor of All Time 10+ Year Member



>>I am considering blocking access of IE9 to my site.

That's pretty extreme, Mario, but I totally get your level of frustration.

It would be great if Google or Microsoft could get involved - we have members who are turning off their products because of this attack. Furthermore, the value of Google Analytics is destroyed by this bogus traffic since there's no filter in GA that can screen it out and the infected machines are hitting the same pages the real users do.
2:04 pm on Apr 24, 2012 (gmt 0)

WebmasterWorld Senior Member netmeg is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month



Right, but when you think about it - what could they do?

I'm not even 100% positive it's illegal, at least maybe not in every country.
2:22 pm on Apr 24, 2012 (gmt 0)

10+ Year Member



Dropped waay down on 19th - averaging 200 visits per day now to the affected page - which is almost back to normal.

Let's hope it stays that way!
2:27 pm on Apr 24, 2012 (gmt 0)



One of our sites is still increasing, up to 35K+ yesterday. Another site dropped from 61K to 38K yesterday. Still finding out solution for this
2:37 pm on Apr 24, 2012 (gmt 0)



It is totally screwing up my web stats. I have no idea how many people are really visiting my site now. I agree that it would be nice for Google to get more involved with this. I think they actually have because looking at my AdSense stats now, they are automatically not paying me for any clicks when the user goes to mysite.com without the www at the front. Remember before I said that a lot of the bots were not using the www at the beginning of the domain.

It is interesting to see that AdSense is blocking that revenue now, instead of later when they do the final month payout. But I still wonder if they are blocking valid clicks, I still think my revenue is lower than it should, and unfortunately I have no idea if my traffic is down this month since I don't have a clue of how many visitors I really have on my site.

I am just thankful that the bots have never went past 10k a day for me. If they do get as high as 60k like other people I am blocking IE9 for sure.
3:11 pm on Apr 24, 2012 (gmt 0)

WebmasterWorld Senior Member netmeg is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month



I would still absolutely recommend not running AdSense on pages hit by this type of traffic. Google has a shoot first, ask no questions policy.

If you continue to do so, it's at your own risk.
4:48 pm on Apr 24, 2012 (gmt 0)

WebmasterWorld Administrator rogerd is a WebmasterWorld Top Contributor of All Time 10+ Year Member



Seems like a first step would be to determine what's causing this. Something is turning machines into elements in a botnet. If it's malware, it may be tough to directly impact. If it's some kind of user-installed software (like Gomez), then at least we have a legal target to go after.
4:53 pm on Apr 24, 2012 (gmt 0)

WebmasterWorld Senior Member ken_b is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month



The target page (my homepage) traffic levels on my site are pretty much down to pre-attack levels and have been for a few days now.

Hope it holds.
5:18 pm on Apr 24, 2012 (gmt 0)



Netmeg,

The problem is that I already removed AdSense from the page that the bots were visiting. The ads I replaced them with were paying hardly anything so I lost money. Then the bots transferred over to another popular page on my site.

The page they are on now does not appear to be getting a lot of ad clicks, and it is really not making a whole lot of revenue. I am getting sick of being held hostage by these things and having to remove Ads. The way my site is laid out, if I remove the ads completely it will have open spaces and look dumb.

I am wondering if these bots are attracted to AdSense or something.
5:27 pm on Apr 24, 2012 (gmt 0)

WebmasterWorld Senior Member netmeg is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month



I understand the problem, Mario155, believe me. I wish there were a solution.
12:58 am on Apr 25, 2012 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



We see these spikes too. Log based analytical are more accurate and seem to ignore these spikes.
6:20 pm on Apr 26, 2012 (gmt 0)

WebmasterWorld Senior Member netmeg is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month



Interesting and weird coincidence; the bot traffic stopped the day of the latest Panda refresh. I'm sure it's a coincidence, but ... weird.
11:24 pm on Apr 27, 2012 (gmt 0)



It hasn't stopped for me. It is actually getting higher and higher each day.
3:24 pm on May 1, 2012 (gmt 0)

WebmasterWorld Administrator webwork is a WebmasterWorld Top Contributor of All Time 10+ Year Member



the bot traffic stopped the day of the latest Panda refresh


Has anyone discussed/evaluated whether "position in the SERPs" has any connection with drawing or sustaining the bot's attention?

Is everyone prepared to say "this is totally random" or how far has the discussion come in identifying commonality?

Perhaps this is a test of a service? In other words, the botoperator is running a test to see what sites it can/may knock down (verticals, link profiles, etc.) AND THEN will offer "its service" to others?

Given the dearth of explanations of a rational for this "attack" it almost makes sense that it would be a trial run of a page-site/knock-down-service . . unless, of course, it truly is a bot gone rogue, i.e., a bot without a mission . . :-/
3:43 pm on May 1, 2012 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Has anyone discussed/evaluated whether "position in the SERPs" has any connection with drawing or sustaining the bot's attention?


Yes, the four original pages this bot pounded on my site all positioned in the serps above the fold at # 4 or better.

It has been my view that this is a Google, Bing or other serp modifiying bot attack.
3:51 pm on May 1, 2012 (gmt 0)

5+ Year Member



I can confirm that since the bot a previous #1 google position for over 5 years has fallen to #6 and seems to be going to drop again. Could this be related?
4:20 pm on May 1, 2012 (gmt 0)



That's an interesting point. And if in that case, "that service" did a good job to hide their information. I really like to know more information about "that vendor"
4:30 pm on May 1, 2012 (gmt 0)

WebmasterWorld Administrator rogerd is a WebmasterWorld Top Contributor of All Time 10+ Year Member



The "high in the SERPs" could be a red herring. Just about every page ranks for some phrase or other. In my case, the bots seem to be hitting some pages that rank for essentially nothing, generate very little traffic from search. The site home page has some rankings that would be considered desirable.
2:00 pm on May 2, 2012 (gmt 0)

WebmasterWorld Senior Member netmeg is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month



The page it hit on my site (home page) was ranking on the first page, but not #1 for many terms. As far as I can tell, the rankings never changed. But the site is seasonal, and it was off season, so it wasn't getting much traffic anyway. That's why it stood out so much.

I wondered if this was some kind of test, and if so, did I pass, fail, or what?

Someone on the post on my site responded that they had actually discussed this with an AdSense account rep and were told that AdSense was seeing a lot of this and they were mystified too.

I'm still getting around 20 or 30 visits a day by this. So it hasn't totally gone away.
6:27 pm on May 2, 2012 (gmt 0)

WebmasterWorld Administrator rogerd is a WebmasterWorld Top Contributor of All Time 10+ Year Member



20 or 30 beats 20K or 30K... :)
10:54 pm on May 3, 2012 (gmt 0)



I can confirm that the two pages of mine which are the focus of the bot were both extremely high in the SERPS for coveted keywords, and they'd just reached that position shortly before the start of the attack.
This 354 message thread spans 12 pages: 354
 

Featured Threads

Hot Threads This Week

Hot Threads This Month