Anyone getting spam web traffic, possibly from Wowrack?

[Archbob]

I've been getting spam web traffic but its different because its not from a certain referrer. When I look in GA, it shows as part of my "direct" traffic but it all comes from one location -- Boston. Only the direct traffic hits I get from Boston are 100% bounce rate.

When I check my access logs, the only large amounts of hits I get to the sites from one IP address outside of the googlebots and facebook spiders is from Wowrack. The only thing is that the IP registers to Seattle and not Boston but Seattle does not snow up on my GA at all. Anyone else have trouble with traffic spam from them?

[NickMNS]

Referrer spam can show up in GA in direct traffic and even in organic traffic. What is the hostname for this traffic?

[Archbob]

its my domain. All my traffic is under my hostname. Google analytics doesn't show IPS so I can't block the IP.

Is it possible for a server in seattle to register as "boston"? The network domain for this traffic seems to be miscrosoft or "msn", that is the service provider.

[edited by: not2easy at 11:33 pm (utc) on May 8, 2017]
[edit reason] privacy [/edit]

[NickMNS]

If it is from your own domain then it is not referrer spam.

Is it possible for a server in seattle to register as "boston"?

I would say yes it is possible, but I'm not sure, there are others here that can confirm this.

[Archbob]

I'm almost sure it is fake web traffic, I can get up to 200 visits a day in GA and the bounce for it is almost always 100%.

[not2easy]

Your domain's raw access logs hold the information you would need to deal with unwanted or abusive traffic. Not as easy to use as GA, but every detail of every visit can be seen.

[NickMNS]

I'm almost sure it is fake web traffic

it depends what you mean by fake. In my mind (a scary place!) referrer spam constitutes "fake" traffic, since none of it ever sees your server. In this case, it is definitely not human traffic, but it is probably real in the sense that it is making requests on your server.

As not2easy says check your server logs. You should be able to match the server entries with the time stamps from GA to find the actual IP or IP's. There is no guarantee that all the these hits are coming from one IP. So the Seattle IP is likely some bingbot (maybe for images) and may not be culprit.

[Archbob]

Well the fake traffic is hitting individual image pages not my homepage, so it may well be a bingbot, still doesn't make sense that its registering to Boston though.

I can't seem to open my raw logs, seems its not compatible with the 64 bit version of windows.

[keyplyr]

GA doesn't give you actual info. It's incorrect much of the time and just doesn't report most activity.

If you are really interested in what is hitting your server you must look at your raw server access logs.

[Archbob]

I've been checking it and it doesn't make any sense really. In my raw logs, I can't find a single IP that's from Boston.

[lucy24]

I can't seem to open my raw logs, seems its not compatible with the 64 bit version of windows.

I am generally perfectly prepared to believe absolutely anything about Windows. But server logs are plain text files, generally in ASCII, so I don't think it is physically possible for them not to be compatible with, well, anything. Depending on your exact operating system, you may need to give instructions about what to do with files that have the .log extension, assuming that's what your server uses.

[Archbob]

Yeah, I fixed the log thing, Needed to change the extension from .com to .txt, forgot about that. But I've been looking through them and even though GA says I get zombie traffic from boston, I don't see any IPS from the boston area in my logs.

[keyplyr]

GA says I get zombie traffic from boston... I don't see any IPS from the boston area in my logs.

That's what I mean. GA may help with Adsense stats but it's totally useless as a traffic & UA indicator. Stick with the raw logs and learn how to separate them and pull out reports using command line or PHP or your favorite programing language.

[NickMNS]

@Archbob as I mentioned before. Find the exact hours, minutes, secs for one of the offending sessions in GA and then check your log a that exact time. Then search based on the IP (assuming you find a matching entry) to see if other entries with that IP coincide with sessions in GA at other times. Like this you will be able to identify the offending ip or ips.