Welcome to WebmasterWorld Guest from 54.160.131.144

Forum Moderators: DixonJones & mademetop

Message Too Old, No Replies

Logs Show Surge, but Not Human?

     

rogerd

9:23 pm on Feb 21, 2012 (gmt 0)

WebmasterWorld Administrator rogerd is a WebmasterWorld Top Contributor of All Time 10+ Year Member



On one site I work with, I've seen traffic go from 10K visits/day to 40K. The additional traffic looks human at first glance - it is captured by Google Analytics, It comes from diverse consumer IPs in the US and Europe (but not Asia), and the bounce rate is high but one out of ten visits or so loads another page.

On the non-human side, we have all of the traffic coming with no referrer, and it is all focused on a few pages that are hardly viral linkbait and would get one or two views on a good day. It's all IE (spread among 6 - 9), and a range of screen resolutions that look unusually aged (e.g., 1024x768).

Anecdotally, I've heard of a few other sites seeing this kind of traffic, but nobody knows what the purpose might be. It's not scraping, as it's the same pages that get hit. It's not intense enough to be an attack to take the site down, nor is the site likely to be the target of miscreants.

The level of traffic has gone up and down, but it's still happening.

Are any of your sites seeing this, and do you have any theories?

Any thoughts on screening this out of Analytics? It totally blows up time period comparisons.

Edge

12:59 pm on May 5, 2012 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



I haven’t been thinking about this botnet thing as I have shut it down and is totally invisible to my stats, AdSense etc. and my server’s can easily handle the load.

The botnet did start hitting a new webpage, so that brings the count to five webpage’s being hit.

I am however, recording the botnet’s activity. There was a huge up tick a couple of weeks ago. I started receiving at least 10,000+ page views an hour up from about 1000 and hour.

Then the botnet started to trickle off page views on May 2 at about 6:00pm est.. There was another significant downtick Yesterday (May 4) at about 9:00 am.

I am curious as to what Google thinks of this..

Edge

12:36 pm on May 6, 2012 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Lessons learned (for me anyway).

I've never been much to experiment with SEO methods and strategies. My philosophy has always been that if there is a really good reason for a visitor to come and keep coming back – they will.

In other words, focus on being helpful, having quality and presenting what the user likely came for.

What this Botnet physically demonstrated to me is that a high bounce rate and a short visit duration (which is what a spammy web site likely has) will affect your AdSense earnings and position within the search engines results.

Webwork

3:01 pm on May 6, 2012 (gmt 0)

WebmasterWorld Administrator webwork is a WebmasterWorld Top Contributor of All Time 10+ Year Member



I am curious as to what Google thinks of this..


What I'm curious about is whether G can "see" if the botoperator is querying the SERPs to a) observe how their bot is affecting sites; b) querying in real-time to study "how many hits/zombie visits" are needed to affect the rankings of various IBL/ranking-factor profiles, etc. Without gathering "effects/ranking data", i.e., what the bot is accomplishing other than harrassing sites, considerable "value of the experiment" would be lost. (Again, this assumes the test is a test of a potential knockdown service/bot.)

I imagine, if the monetization model is a knockdown service, that the botoperator needs a lot of data to determine pricing, etc. That data would involve "observing/querying" the relevant SERPs and aggregating that data both in real time (to tweak inputs) and at the end of "the study". If "the service" will be for a private/criminal network then te data would be more for strategic deployment purposes.

I was also wondering if "this system" could be used "to tweak" Google's content network PPC pricing algo/smartpricing". If a well structured bot could affect G's PPC, by artificially lowering/raising bids on the content network, then I imagine that ability could be financially exploited.

hottrout

4:34 pm on May 8, 2012 (gmt 0)

5+ Year Member



Well I have just had my site PR drop from 5 to 4 today and I can only think that this is related to these attacks.

Does anyone have any clue how to stop this?

netmeg

1:55 pm on May 9, 2012 (gmt 0)

WebmasterWorld Senior Member netmeg is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month



No, that's not related to the attacks. PR is about links. Either you lost some links, or possibly some of the links you still have were devalued a bit. The bots can't affect PageRank.

Archbob

2:20 am on May 11, 2012 (gmt 0)

5+ Year Member



I've been having this issue for 2 months or more now. I noticed that it doesn't effect PPC or SERPS on my site, it just makes my bounce rate look really high which is very annoying.

Archbob

2:23 am on May 11, 2012 (gmt 0)

5+ Year Member



I got a response from Gomez saying my URLs are not in their system but I don't believe them. The traffic matches their software nicely. Only MSIE. Mostly from Tier-1 countries. Loads javascript and many webmaster reported an increase around the time Gomez was launched. Too many signals pointing to them to be ignored.

hottrout

1:28 pm on May 11, 2012 (gmt 0)

5+ Year Member



What is gomez? Can you provide more info about it please.

twitch

4:37 pm on May 11, 2012 (gmt 0)



Do you mean [gomez.com...] I Never signed up there.

Mario155

10:46 pm on May 16, 2012 (gmt 0)



I am getting a few thousand links coming in from your.schoolfeed.com and bingo.schoolfeed.com

I am not sure if that site is related to this attack. It should be noted that these links do not show up in Google Analytics, but they do show in my web logs which I download and view in a different program.

School Feed appears to be a facebook or classmates.com ripoff website. The referring links just go to a generic page of their site, so I assume I need to be signed up and/or on someone's friend list to view how my site was linked to them.

I am wondering if they have some sort of spambot thing going on, because I don't see how I would get thousands of links from that site when I get much less from Facebook, which is a much larger site.

hottrout

9:02 am on May 23, 2012 (gmt 0)

5+ Year Member



This weird traffic remains constant and has now been corrupting the google stats for three months. It has made a nonsense of my analytics and is a major pain.

Has anyone had any ideas on how to prevent this or does anyone have a solution to the problem?

A lot of people have this issue so I cant understand why nothing has been done or why google has had nothing to say!

twitch

8:56 am on May 25, 2012 (gmt 0)



hey hottrout, there is no solutions for that dump stuff at the moment.

hottrout

9:03 am on May 25, 2012 (gmt 0)

5+ Year Member



I know but it seems hard to believe. So many people are being so badly effected that you would imagine Google must be aware of it?

Shatner

5:25 pm on May 28, 2012 (gmt 0)



Update on this... this morning they upped their efforts on me and started hitting new pages.

This time I was able to track the referral address, it's coming from here...

[108.166.83.225...]

The company is named Adssourcing, Inc. It's from Bangladesh. I have no idea how to stop it or how they're doing it though.

Any thoughts?

Shatner

5:34 pm on May 28, 2012 (gmt 0)



There's a note on their site that they recently moved servers, I wonder if that's why I'm able to see the referrer now wheras in the past it was coming through as direct traffic all the time?

macavity

6:56 pm on May 28, 2012 (gmt 0)

10+ Year Member



Hi Shatner,

Are you still seeing the direct traffic in addition to this new wave or did the direct traffic drop at the same time this appeared? I'm not seeing 108.166.83.225 in my logs - could this be a separate issue?

Shatner

7:20 pm on May 28, 2012 (gmt 0)



@macavity

Yeah actually now I'm wondering if this is a separate thing, because I'm still seeing the direct traffic in ADDITION to this.

Also while ALL of this traffic comes from Bangladesh, the direct traffic is from all over the geo.

macavity

7:51 pm on May 28, 2012 (gmt 0)

10+ Year Member



OK, thanks (my direct traffic is from US/Canada).

Igal Zeifman

9:58 am on May 29, 2012 (gmt 0)



Recently our company released a a study that show that on average 50% of your site traffic is just bots (some very bad ones - scanners/spammers/scouts). For small sites 2500 visitors/month the numbers can be as high as 80%...

But... usually such bots are not shown by GA since they do not activate JavaScript.

I think you might be dealing with botnet DDos attack.

Seb7

11:21 am on May 29, 2012 (gmt 0)

5+ Year Member



Yep, my stats have been showing more bots than humans for at-least the last three years. Igal is correct, you cant tell this by using GA.

Staffa

12:34 pm on May 29, 2012 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



I agree with Igal and Seb7, I have been bot hunting for the past 10 years (it's a sport) and the number of IP ranges that I have now blocked is mindboggling.

netmeg

6:03 pm on Jun 1, 2012 (gmt 0)

WebmasterWorld Senior Member netmeg is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month



This particular attack had specific markers, and not like some of the things being reported here.

They were all MSIE

Various forms of Windows.

All direct traffic (no referrer)

Usually just hit from 1-4 pages on a site (in my case, it only ever hit the home page)

From all over the world.

Executed javascript.

Anything else is a different kind of bot (and yes, there are lots)

Google hasn't said anything because most likely there's nothing they can do. They're not causing, and there's no reason to think they can stop it. This traffic looks exactly like human type browser traffic. I personally am still of the opinion it's some kind of a malware thing.

Mine stopped on April 19, and as far as I know, it's not still going on - but at this point, I have too much normal traffic on that site to notice (unless it was REALLY huge) But some other people are still seeing it.

I've seen some interesting visitors to the blog post about it on my site, including some big ISPs and the Dept of Defense. So maybe some others are starting to take notice.

But ultimately, I don't think there's any point in waiting for a solution, because right now, there's none on the horizon.

justawriter

7:47 pm on Jun 1, 2012 (gmt 0)

5+ Year Member



Is Roger still getting hit with this traffic?

Archbob

4:01 pm on Jun 2, 2012 (gmt 0)

5+ Year Member



Does anyone know how to show an ad or load a page only if you detect mouse movement or mouse clicks?

netmeg

1:48 pm on Jun 4, 2012 (gmt 0)

WebmasterWorld Senior Member netmeg is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month



We talked about it, but I never did exactly figure out how to do it.

Last I heard, Roger was still getting hit but I haven't talked to him about it recently. Next time I see him on twitter I'll ask.

brotherhood of LAN

1:57 pm on Jun 4, 2012 (gmt 0)

WebmasterWorld Administrator brotherhood_of_lan is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month



>Does anyone know how to show an ad or load a page only if you detect mouse movement or mouse clicks?

Those can be replicated just as easy. Going by netmeg's explanation of the visits, they would appear to be browsers rather than command line clients.

You should be able to get a mouse pointers position within a browser window using javascript though.

IMO, check that these are indeed IE browsers by executing some javascript only IE would understand... if you catch it out then that's a pretty big flag you can work with.

rogerd

5:37 pm on Jun 4, 2012 (gmt 0)

WebmasterWorld Administrator rogerd is a WebmasterWorld Top Contributor of All Time 10+ Year Member



Unfortunately, my bot traffic actually increased in mid-April and remains at a high level.

Archbob

8:03 am on Jun 5, 2012 (gmt 0)

5+ Year Member



Has anyone found out what kind of malware is causing this traffic? It seems that they are getting more nodes

Archbob

8:19 am on Jun 5, 2012 (gmt 0)

5+ Year Member



Its completely IE that these bots are using.

anallawalla

5:23 am on Jun 20, 2012 (gmt 0)

WebmasterWorld Administrator anallawalla is a WebmasterWorld Top Contributor of All Time 10+ Year Member



Just about every page ranks for some phrase or other. In my case, the bots seem to be hitting some pages that rank for essentially nothing, generate very little traffic from search.


If this botnet is testing a Negative SEO offering, then they ought to test on an obscure phrase that is not competitive, because such a SERP will not have a lot of variables, e.g. regular competitive SEO activity.
This 354 message thread spans 12 pages: 354
 

Featured Threads

Hot Threads This Week

Hot Threads This Month