Websites Affected By Zombie Traffic - Observations & Analysis

[reseller]

I wish this thread to focus on latest observations and analysis of WebmasterWorld members who do believe that their website(s) are negatively affected by the so called Zombie Traffic.

A friendly remark: If you want to talk about PPC issues please head over to Google Adwords forum [webmasterworld.com...]
If you want to talk about Google business decisions please head over to the Google Business & Finance forum [webmasterworld.com...]
If you want to vent some frustration then head over to Foo [webmasterworld.com...]

[glakes]

Is your view that the zombies are actual humans who click through sites ?

Yes.

In my world view then the zombies are bots that live inside chrome.

I sell to a lot of businesses which do not use Chrome. From my data, zombies are not predominantly Chrome users and are not restricted to mobile or desktops.

[tangor]

That's precisely right. If you mess with them, they mess with you. But I had to play with them to find out. As for good reasons for blocking them, they should mind their own business is good reason enough.

This reply is not to stray from the topic, but I have to remark that's pretty bogus and might be an indication why some traffic just isn't "human" and wonder if the other folks with zombie traffic (as described) are also pushing boundaries of commonsense presentation to the web. You have a site or you don't.

1. Why hide product from g?
2. Why cry foul when traffic does not appear/convert?

Unlike others on this thread, I am looking at the SITES and webmasters, not so-called zombies, for why traffic does not convert. I have no conclusion to offer other than it appears a narrow group of webmasters are doing "something" (a variety of whatever that might be) is experiencing this kind of traffic, and I say this in the regard that the REST OF US (that is "us" as in other webmasters, not the United States of America) are not seeing the same kind of traffic. What we do see, and have always seen, is hit or miss non converting traffic that appears normal or robotic and not some kind of crazy tinfoil kind of campaign by g to generate completion of sales quotas and denial of "more sales".

The many discussions on WW re: Zombies so far seems to indicate that the websites that see this behavior are "not regular", open, or have some other kind of impediment which G in Particular has a problem. I suspect that NickMMs sees something different than I do and I also suspect that we STILL do not have enough information from all concerned to make any real explorations.

Those with Zombie problems, can you reveal (without breaking TOS here at WW) what KIND of ecommerce you are involved in? eg. entertainment, software, product, info or other?

Do you block g for any reason (don't have to reveal reason, just affirm if you do or not, and that includes IMAGES, VIDEO, AUDIO).

Are you EU or USA? Are you another Geo Location?

What HOURS your time do these Zombies arrive?

Do your logs reveal what UAs are involved and have all IPs been researched?

Are you compliant with EU cookie law if your site is of interest in the EU?

I have no doubt that some experience traffic as described. I'm not saying "zombies" don't exist ... but I am begging for something more concrete than what has been presented.

Exact details that do not defy the WW limits on links to sites are needed. Something in the mix is missing and without more data this whirly-gig "he said she said" and near name calling will continue and nothing will move forward.

[glakes]

This reply is not to stray from the topic, but I have to remark that's pretty bogus and might be an indication why some traffic just isn't "human" and wonder if the other folks with zombie traffic (as described) are also pushing boundaries of commonsense presentation to the web.

Your post is not straying from the topic in the slightest. Each site has its unique characteristics and may be interpreted by Google differently. I will say in my case we only block backend admin pages, which are not openly linked to, using robots.txt. On public pages we don't want found (pages spammers typically exploit including account login, cart, etc.) we use noindex. Everything else, including CSS, is wide open for Google to view and images can be hotlinked. This is quite common among many healthy sites and the valid use of exclusions in robots.txt and the use of noindex are not the reasons why I am seeing zombies. To expand on this a little further, restricting Google's access to content should result in lower traffic. Many of us with zombies have higher traffic then the pre-zombie days. In my case the total quantity of Google traffic is much higher then it was in 9/2015 when the zombies arrived. If a site were penalized or under suspicion because all resources can't be crawled, one would think they would have traffic that trends lower, warnings in GSC, etc. which I don't have.

[NickMNS]

@NoobOperator
Let me be clear:
The ip addresses that you posted (c-block) 66.102.8 and 64.233.172
Are assigned to Google.
When I look these addresses up in my logs, I find several entries. When a referrer is shown it is from Google properties that operates in third world countries such as but not limited to Brazil (.br) and India (co.in). For the majority of the entries there is a reference to either Googleweblight or Google Translate.

So from this information I conclude that these addresses are seen when a user uses a Google service such as (but not limited to) Googleweblight or Google translate.

In both these example, Google is taking the page and changing the way it is displayed to the user.

These changes may break the page layout.

This paired with the fact that user's language is most likely not English can lead to some strange behavior on the part of the user (eg: clicking on links not normally clicked on).

This is all I am claiming.

I wonder whatever happened to the "freedom" you are supposed to have in the US

Your are free disagree with me, as I am free to disagree with you.

Your are free to think that my logic is dumb.

When discussing issues related to Google, you must remember that Google is a private company that provides a service free of charge. You have a right not to use it, but otherwise Google makes the rules and you really have no choice but to abide by them, or as I said not use their services.

[aristotle]

access_log-20170206:66.102.8.28 06/Feb/2017:02:06:36 "/[censored]E.zip" "http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&ved=0CDQ___AB&url=https%3A%2F%2Fwww.[censored].com%2F[censored]E.zip&ei=K9qXWNiR____0wPFZQ&usg=AFQjCNGGv94dK7zho1____sG3oTWsmM8QQ" "(Windows 10.0; x64) Chrome"

access_log-20170206:64.233.172.130 06/Feb/2017:02:06:42 "/[censored]E.zip" "http://www.google.co.uk/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&ved=0CCwQFj____rl=https%3A%2F%2Fwww.[censored].com%2F[censored]E.zip&ei=MtqXWJm8M4SX6___sgE&usg=AFQjCNGGv94d____o161GDsG3oTWsmM8QQ" "(Windows 7; WOW64) Chrome"
[edited by: NoobOperator at 11:41 pm (utc) on Feb 8, 2017]

Maybe I'm going blind, but I don't see the response codes in those entries, or maybe you censored them, but I can't imagine why you would do that.

At any rate, googlebot doesn't normally crawl from those IPs

[NoobOperator]

@glakes

I sell to a lot of businesses which do not use Chrome. From my data, zombies are not predominantly Chrome users and are not restricted to mobile or desktops.

It is not possible to tell what browser the zombie is using. Those web request can be generated with any user agent string. So a zombie inside chrome can access a site and report itself as firefox for instance. In fact you can test this yourself. Get a copy firefox and change its user agent string to say "glakes special browser". When you access other people's sites, you will appear in their logs as using "glakes special browser".

The trouble with human zombies is that they are too expensive, and from the technical stand point they are redundant because they can easily be replaced by lines of code.

[edited by: NoobOperator at 6:30 pm (utc) on Feb 9, 2017]

[NoobOperator]

@tangor

1. Why hide product from g?
2. Why cry foul when traffic does not appear/convert?

Can't give answer to all your other questions without risking going off topic. They are all good I assure you.

1. No reason to block google if they don't cut off traffic after they download. The reasoning is that if download causes traffic cut, then no download would means no traffic cut ? Of course the logic is flawed in practice.

2. I cry because after traffic cut, all I get are zombies. They are not much use for anything.

[NoobOperator]

@aristotle

Maybe I'm going blind, but I don't see the response codes in those entries, or maybe you censored them, but I can't imagine why you would do that.

At any rate, googlebot doesn't normally crawl from those IPs

The response code from my server was 200, meaning google could download as much as they wanted. I tend to look at a tidied up version of the apache log. So some of the information are implied.

Those are not googlebot addresses. This is what makes them special. I regard them as google's rapid reaction special operations addresses. Their operational motto is: "You do kerchinggg, we come running faster than your local fire brigade !". The significance of those addresses relative to zombies is that human traffic is largely cut off after download from those addresses. Thereafter, the zombies reign until the sun shines once again about a month down the line.

[aristotle]

The response code from my server was 200

You didn't show that in your post, so we didn't have any way to know.

I tend to look at a tidied up version of the apache log

Bad idea. You might miss seeing an important piece of information that could reveal a problem with your site

Those are not googlebot addresses

I already said that.

I regard them as google's rapid reaction special operations addresses. Their operational motto is: "You do kerchinggg, we come running faster than your local fire brigade !".

You said that you serve a response code of 200. If that's true, then how could you know what google does in other, less-friendly cases?

[NoobOperator]

@aristotle

You said that you serve a response code of 200. If that's true, then how could you know what google does in other, less-friendly cases?

Perhaps you are not as adventurous as I am. But I tend to test and play with anything that want to stick their nose into my business. If I know their responses, then I stand a better chance of contending with them. In the less friendly case, they would scare your customers witless and they would paint your search console red.

[aristotle]

Perhaps you are not as adventurous as I am. But I tend to test and play with anything that want to stick their nose into my business. If I know their responses, then I stand a better chance of contending with them. In the less friendly case, they would scare your customers witless and they would paint your search console red.

So why don't you tell us about your "test and play" activities. As it stands, you haven't proved or demonstrated anything.

[NoobOperator]

@aristotle

I have already tested and played and telling you the result. There's nothing more to be done. I am not seeking to prove anything, and just stating my experience and belief. You are welcome to state your experience. Perhaps we can compare notes on the wooden zombie beeches ?

[aristotle]

NoobOperator -- Traffic coming through proxies is nearly always worthless. I would bet that hardly any of it comes from Google search results. Most likely nearly all of it is bots. My suggestion to you is to forget about it.

[NoobOperator]

@aristotle I use proxies to check out the competition. I suspect they do likewise. These traffic are useful since they mark themselves out as threats. I have no experience of zombies using proxies. People using proxies usually want to have a good old click-around if not lifting my entire site content.

Of course the other use I have for proxies is to give the zombies a nudge. I do that when bored. I have no expectation anything good would come from that.

[aristotle]

I regard them as google's rapid reaction special operations addresses.

I thought you were going to explain that, but somehow you didn't.

[NoobOperator]

@aristotle

A key point of spec ops is that there is no info on them. Other than the operational characteristics I already stated for them, there's nothing more to be had. Just thank your lucky stars they don't grace your site. Otherwise you are going to learn the real intimate meaning of zombies.

[tangor]

Again, from the outside, I'm trying to learn what actual harm occurs. To me bad traffic is just bad traffic and unless, and until, it actually costs more than a few cents of bandwidth is merely the cost of doing business. When that happens out comes the htaccess and block bans on ips/ranges.

If, as it appears in commentary, that zombies are some sort of stealth traffic organized by g, I have to ask "to what purpose?"

[NoobOperator]

Zombie traffic as well as restricted real traffic can be used as appetisers for paid-for traffic. The goal is for paid-for. This is why free-loaders like me gets strangled on a monthly basis. They don't want me to die and they don't want me to load up, but just enough for a taste of what could be. The trouble is they are not generous enough to convince me paid-for is viable.

[Shaddows]

Hold on, this conversation has moved on a long way since the comment, but...

If we continue down this path, I can make you look extremely embarrassing. Do you really want to go there ?

What? Is this how we converse now?

[NoobOperator]

@Shaddows

What? Is this how we converse now?

Quite obviously not. But it was the way I conversed. That path was a dead and unfruitful end. I was highly irritated and frustrated. But that path was bought to a close quickly enough for my converse to be worth the cost, whatever that maybe. The benefit was that some embarrassment was saved anyway.

[Shaddows]

The benefit was that some embarrassment was saved anyway.

I'm sure we're all relieved in this instance, though wait on tenterhooks for a demonstration of your awesome power to embarrass those with whom you disagree.

[NickMNS]

@NoobOperator the only person you are embarrassing is yourself. Please don't take my lack of further engagement with you as some sort of tacit retraction and retreat.

[NoobOperator]

@Shaddows

I am new here and not sure what the limits are on observation of the thread starter's wishes. So, you lead on and I follow.

The other poster was saying those google IP's were under indian and brazilian control. What is you view on it ? All I have now are zombies and polish script kiddies (trying to hack my product) for company at the moment. So I have time to go down the path with you.

[reseller]

Hi Folks

Friends please.

Lets return back to discuss observations and analysis of those Zombie things :)

Thanks and God bless.

[NoobOperator]

@reseller

Please can I include the polish and russian script kiddies ? They are all I have for the rest of the month. Those zombies don't talk or do much and will drive me insane.

[reseller]

@NoobOperator

I suggest you ask the moderators, just to be sure.

[iamlost]

Two obvious points:
1. despite sharing continuing angst none of the afflicted have shared potentially helpful analytics, per my earlier suggestion, which raises in turn concern as to whether they want practical assistance and actual answers or mere sympathy.

2. in our web world there are four primary inputs: what we do, what competitors do, what referrers (in many/most cases this renders down to Google) do, and what visitors do. And each, with the possible exception of complacent webdevs) is in constant flux. Simply to remain as is requires a whole lot of effort, without continuing effort across a variety of inter/overlocking disciplines one will most likely fade from view, notably from search/Google results view.

That aside I have some further comments. :)

One type of visitor we have a love/hate relationship with is bots/crawlers. Outside of marketing my greatest effort over the last decade has been identifying and appropriately handling bots. Over the same period bots have become increasingly capable and sophisticated. Increasingly able to mimic human browsing behaviour. And increasing arriving via search results. Google search referral is not a guarantee of visitor humanity. Even Google, just as most other SEs, check sites without 'proper' identification; can you detect when they do?
Which raises a critical set of questions:
Do you have bot defences?
---if so, how effective do you rate them? How do you derive/trust that rating?
Note: Google Analytics (or any other standard analytics program) can (increasingly) not identify many/most bots.
---if not, how accurate do you believe your visitor/conversion numbers/analytics? Why?

Despite being an amazing achievement Google search is not omnipotent. It makes frequent gross errors in query results. In many instances RankBrain appears to be having severe learning on the job difficulties, which means that for the past year we have experienced a preschooler telling us what is what. Usually the first answer is appropriate, often the first several, however for a great many queries the remaining results appear to be drawn at random from a hat. If a human searcher is not paying attention they will be sent to all sorts of totally inappropriate (for their query) places. Sound familiar?

One of the critical pieces of data missing in this conversation is that of the visitors' IPs. Too many webdevs do not, or do know how to, check IPs against behaviour and stated identity. I have often listened to people discuss Google traffic as if all traffic from Google IPs is Google search traffic. Far, and daily getting further, from the truth. Google has all sorts of platforms and applications besides search. To add a wrinkle many bot wranglers (and others) spoof a Google user-agent string and/or use a Google cloud address to confuse the unwary.
Which raises another set of questions:
Do you rely solely on the user-agent string or do you confirm against IP?
---if yes (sole), why do you believe this is sufficient?
---if no (confirm), do you also confirm IP against expected service IPs? If not, why not?

So: if one can not separate bot from human visitors, human visitors by their geo-location, etc. how can you possibly trust your analytics information? GIGO.

Further, traffic volume can be an especially important consideration when considering patterns.
A very simple example why:
A site with ~100 unique visitors a day (~3000 a month); 50% are bots; 2% of human visitors convert: 2% of 50 is 1 conversion a day.
Bot traffic volume increases to 75%: 2% of 25 is 1 conversion every other day.
Bot traffic volume decreases to 25%: 2% of 75 is 3 conversions every 2-days.
Because conversions are not precisely regular if there are many more one day statistically there may not be another for several days. Good days, bad days, so so days. Over longer periods the pattern smooths, looks more regular than at a less granular level.

Now, lets look at a site with 100,000 unique visitors a day (~3-million a month); 50% are bots; 2% of human visitors convert: 2% of 50,000 is 1,000 conversions a day.
Bot traffic volume increases to 75%: 2% of 25,000 is 500 conversions every day.
Bot traffic volume decreases to 25%: 2% of 75,000 is 1500 conversions every days.
Because conversions are not precisely regular if there are many more one day statistically there may not be quite so many for several days. Good days, bad days, so so days. Over longer periods the pattern smooths, looks more regular than at a less granular level.
But it can be seen as a fluctuation of peaks and troughs rather than heights and blanks.

Now add in the traffic referred from poor query responses, all the mis-identified Google application traffic, all the not desired geo-location traffic, all the rest that Google is doing, all that your competitors are doing, all that visitors desires/behaviours change, and all that you may or may not be doing.

The less trafficked the site the more of the pattern is below an event horizon. And the less information is available.

None of which says that 'zombie' effect traffic doesn't exist, just that those affected have not shared sufficient data for analysis to say what zombie traffic actually is. Some of us may have suspicions but we can't prove it.

My personal belief is that what is seen is an artifact created by some combination of other things rather than one specific 'thing'. Shades of the Google 'sandbox' imo. Further, given the relatively few webdevs reporting (a large absolute number can be a small percentage of the total) and any evidence beyond 'what else can it be' I see the sites impacted as more likely false positives than specifically targeted - if - I say again, if - what they are experiencing is not an artifact but the result of single action.

And unless those affected share actual data I'm out of the entire conversation.
Bon voyage.

[aristotle]

NoobOperator -- Those two IPs in your examples from your logs are proxies owned by google, but most likely mainly used by rogue bots. I doubt that much human traffic comes through them. Trying to block all the bots while letting the humans through would require a lot more time and trouble than it's worth. As I said before, my suggestion is to forget about them.

[tangor]

Looking at what little data is revealed most of these appear to be either bots which appear near human or google services/proxies of softwares looking for anything, or some advanced "prefetch" features in some browsers. Instead of looking for zombies, look for bots and deal with those proactively. A weeks worth of study, a few hours updating htaccess can have a benefit that will extend for several months, if not forever (depends on how often htaccess is updated).

Remove the bots then look at the actual traffic that is left and decide if peaks and valleys are more closely related to when potential customers are on line rather than a tinfoil conspiracy.

As iamlost indicated, we have too little info for the "zombie" problem a significant (though not overly large) number of webmasters have identified ... but have not codified with data which can be tested by others.

I fear we're looking at mis-identification of bot activity and looking for something nefarious to explain falling revenues when other real world possibilities more closely address what is being seen.

Bot whacking can be a full time job, as is log analysis. The wrong place to look for that last bit of control is g-analytics or any "revenue" reporting. Raw logs is where one has to get their hands dirty.

[NoobOperator]

@aristotle

Those two IPs in your examples from your logs are proxies owned by google, but most likely mainly used by rogue bots.

They could be indian or brazilian bots ? Your guess is no better than the other guy.

It makes no difference if they are human or bot. My consideration for them is they are capable of cutting off my traffic, making my search console look funny, and intimidating my customers. I am unconvinced the indians and brazillians are capable of that, because I know the entity who is capable.