Direct traffic spikes

[baldidiot]

Anyone else noticing spikes in direct traffic that look suspiciously similar in nature to the kind of referral spam that's been a pain in most of our asses the past year or so?

Can't quite figure out the purpose of it though. Is it somebody who just hasn't configured whatever script or program they're using to send referral spam correctly so no referral data is passed, or is there actually a point to it?

Scratching my a head a bit with this one...

[smartuner]

I saw this in GA today. Yesterday my direct traffic increased by over 50% but it has a 100% bounce rate and all coming from US while my normal traffic is only 10% US.
Pretty annoying would be interesting to know where this is coming from

[wonderpunter]

Not sure if it's still he same now.. but a lot of bing/yahoo traffic used to show up as direct, due to privacy.. this changed when google started adding more not provided statuses..?

[baldidiot]

Not sure if it's still he same now.. but a lot of bing/yahoo traffic used to show up as direct, due to privacy.. this changed when google started adding more not provided statuses..?

I don't think it would be this as we're seeing spikes over a short time frame - say 30 to 50 visitors from around the work in the space of 5 minutes. If it were search related I'd expect it to be more spread out.

There are other pattens in the traffic too - same time on site, landing page, bounce rate etc.. Seems to happen around the same kind of times each day too.

Also whist each visit comes from a different IP spread around the world, the operating system and browser are identical (including exactly the same version) which could imply it's coming from the same person with multiple proxies.

[wonderpunter]

In that case it's a Spam bot, or scraper.. or websitespeed test which someone is running on your site

[golfbettingsystem]

Getting loads of it too, on one relatively low traffic domain it's making up 80% of the traffic most days - muddies what are already pretty murky waters for sure.

[sweetbet]

I'm seeing the same thing on my site also. The number of hack attempts has also significantly increased.

[vardan]

Yes, the same here from the end of April. A few tenths direct visits almost everyday with 90-100% bounce rate, especially from the US.

[dfiocch]

US, Russia, Poland, Italy, China...

Spam bots coming from: ilovevitaly.com, sanjosestartups.com and some other spamming websites.
I partially solved this issue with a combination of "analytics filtering" and .htaccess blocks.

If someone need some "tips", I'm here

[casinoaa]

Set filters in google analytics setup. They only slow your sites but not affect your SEO rank.

[baldidiot]

US, Russia, Poland, Italy, China...

Spam bots coming from: ilovevitaly.com, sanjosestartups.com and some other spamming websites.
I partially solved this issue with a combination of "analytics filtering" and .htaccess blocks.

If someone need some "tips", I'm here

This traffic doesn't have a referrer though, it's just suspiciously spammy direct traffic that I can't figure out the point of....

Also means I don't think it can be blocked as there's no identifiable feature.

[dfiocch]

This traffic doesn't have a referrer though, it's just suspiciously spammy direct traffic that I can't figure out the point of....

Also means I don't think it can be blocked as there's no identifiable feature.

I see the referrers (posted in my previous post).
At this point, someone is directly spamming your stats code

[baldidiot]

I see the referrers (posted in my previous post).
At this point, someone is directly spamming your stats code

Yeah I know about the ones you've mentioned and also get those, but what I meant is this is something new I'm seeing that doesn't have any referrer - it's marked as direct.

[TheGooner]

As I understand it - any visits that are marked as no referrer are probably direct.

If it's a large string of pages done at the rate of 2/3 per second then it will be a spammer or scraper bot that has collected a large list of your pages from a previous visit. Now that it has a list of pages ity checks all the pages directly.

If you have the ip address you will be able to reverse IP check and you might come up the the server farm where the bot originates and can then block that IP address if you want.

Typically amazon aws is a prime source but I also found a new one today at a place called Nobis technology (Ip range 23.105.54.*)

I track several pages on my site (a mix of stats recording an honeypot tracking) and will find 2-3 or these new bots a week and block them to stop future scraping.

[xecutable]

Saw that too, apparently a Russian bot or something cause the address showed up as 4webmasters or something like that. I usually logcheck on Wordfence and just ban the IP or the whole IP range.

Feels like sometimes i should block a whole country, but then again, what's the reader's fault that 99% of the bots come from his particular country.

[pettersson]

I have seen similar traffic in one of my sites. I think that in my case its some new spider/crawler that GA is not filtering out.

[universal4]

My guess is that a lot of the traffic that does not include a referral are a combination of hackers looking for admin logins as well as spam type bots, Most of these would use port 80 and likely fake their user agents so as to appear to be real web traffic.

If anyone considering blocking by IP or subnets, let me know and I'd be happy to help you figure out the subnet blocks, although I rarely block much on the web servers unless the ip's are extremely bad actors.

Keeping mail and dns on different servers has great advantages in cases such as these.

Rick
Universal4

[wettFORM.AT]

I noticed some more direct traffic but I am not sure what the reason was. I can´t find any spam links pointing to my site but the visits were definitely over the average without any reason.

[baldidiot]

As I understand it - any visits that are marked as no referrer are probably direct.

If it's a large string of pages done at the rate of 2/3 per second then it will be a spammer or scraper bot that has collected a large list of your pages from a previous visit. Now that it has a list of pages ity checks all the pages directly.

Could be scraping I guess, although all of the traffic only ever hits the homepage.

Saw that too, apparently a Russian bot or something cause the address showed up as 4webmasters or something like that. I usually logcheck on Wordfence and just ban the IP or the whole IP range.

Feels like sometimes i should block a whole country, but then again, what's the reader's fault that 99% of the bots come from his particular country.

Unfortunately every single visitor is a different IP spread across 20+ countries so it would be difficult to block... I might delve deeper into my logs though and see if there are any kind of patterns.

My guess is that a lot of the traffic that does not include a referral are a combination of hackers looking for admin logins as well as spam type bots, Most of these would use port 80 and likely fake their user agents so as to appear to be real web traffic.

If anyone considering blocking by IP or subnets, let me know and I'd be happy to help you figure out the subnet blocks, although I rarely block much on the web servers unless the ip's are extremely bad actors.

Keeping mail and dns on different servers has great advantages in cases such as these.

That's an interesting suggestion, I hadn't thought of it being connected to hacking. Will keep a closer eye on it.