Results 1 to 19 of 19
  1. #1
    baldidiot is online now Private Member
    Join Date
    January 2010
    Posts
    4,441
    Thanks
    409
    Thanked 2,014 Times in 1,328 Posts

    Default Direct traffic spikes

    Anyone else noticing spikes in direct traffic that look suspiciously similar in nature to the kind of referral spam that's been a pain in most of our asses the past year or so?

    Can't quite figure out the purpose of it though. Is it somebody who just hasn't configured whatever script or program they're using to send referral spam correctly so no referral data is passed, or is there actually a point to it?

    Scratching my a head a bit with this one...
    onlinegamblingwebsites.com - Formally known as goodbonusguide.

  2. #2
    smartuner is offline Public Member
    Join Date
    March 2015
    Posts
    39
    Thanks
    17
    Thanked 21 Times in 14 Posts

    Default

    I saw this in GA today. Yesterday my direct traffic increased by over 50% but it has a 100% bounce rate and all coming from US while my normal traffic is only 10% US.
    Pretty annoying would be interesting to know where this is coming from

  3. #3
    wonderpunter's Avatar
    wonderpunter is offline Private Member
    Join Date
    August 2013
    Posts
    2,526
    Blog Entries
    5
    Thanks
    402
    Thanked 1,685 Times in 1,013 Posts

    Default

    Not sure if it's still he same now.. but a lot of bing/yahoo traffic used to show up as direct, due to privacy.. this changed when google started adding more not provided statuses..?

  4. #4
    baldidiot is online now Private Member
    Join Date
    January 2010
    Posts
    4,441
    Thanks
    409
    Thanked 2,014 Times in 1,328 Posts

    Default

    Quote Originally Posted by wonderpunter View Post
    Not sure if it's still he same now.. but a lot of bing/yahoo traffic used to show up as direct, due to privacy.. this changed when google started adding more not provided statuses..?
    I don't think it would be this as we're seeing spikes over a short time frame - say 30 to 50 visitors from around the work in the space of 5 minutes. If it were search related I'd expect it to be more spread out.

    There are other pattens in the traffic too - same time on site, landing page, bounce rate etc.. Seems to happen around the same kind of times each day too.

    Also whist each visit comes from a different IP spread around the world, the operating system and browser are identical (including exactly the same version) which could imply it's coming from the same person with multiple proxies.
    onlinegamblingwebsites.com - Formally known as goodbonusguide.

  5. #5
    wonderpunter's Avatar
    wonderpunter is offline Private Member
    Join Date
    August 2013
    Posts
    2,526
    Blog Entries
    5
    Thanks
    402
    Thanked 1,685 Times in 1,013 Posts

    Default

    In that case it's a Spam bot, or scraper.. or websitespeed test which someone is running on your site

  6. #6
    golfbettingsystem's Avatar
    golfbettingsystem is offline Public Member
    Join Date
    March 2014
    Location
    Bedfordshire
    Posts
    756
    Thanks
    152
    Thanked 374 Times in 262 Posts

    Default

    Getting loads of it too, on one relatively low traffic domain it's making up 80% of the traffic most days - muddies what are already pretty murky waters for sure.

  7. #7
    sweetbet's Avatar
    sweetbet is offline Public Member
    Join Date
    November 2012
    Posts
    2,819
    Blog Entries
    5
    Thanks
    898
    Thanked 1,575 Times in 1,087 Posts

    Default

    I'm seeing the same thing on my site also. The number of hack attempts has also significantly increased.

  8. #8
    vardan's Avatar
    vardan is offline Private Member
    Join Date
    March 2014
    Location
    Barcelona, Spain
    Posts
    428
    Thanks
    383
    Thanked 226 Times in 155 Posts

    Default

    Yes, the same here from the end of April. A few tenths direct visits almost everyday with 90-100% bounce rate, especially from the US.
    Last edited by vardan; 29 May 2015 at 5:04 pm.

  9. #9
    dfiocch's Avatar
    dfiocch is offline Private Member
    Join Date
    September 2006
    Posts
    878
    Thanks
    789
    Thanked 567 Times in 350 Posts

    Default

    US, Russia, Poland, Italy, China...

    Spam bots coming from: ilovevitaly.com, sanjosestartups.com and some other spamming websites.
    I partially solved this issue with a combination of "analytics filtering" and .htaccess blocks.

    If someone need some "tips", I'm here

  10. #10
    casinoaa is offline Public Member
    Join Date
    April 2015
    Location
    Italy
    Posts
    13
    Thanks
    0
    Thanked 10 Times in 5 Posts

    Default

    Set filters in google analytics setup. They only slow your sites but not affect your SEO rank.

  11. #11
    baldidiot is online now Private Member
    Join Date
    January 2010
    Posts
    4,441
    Thanks
    409
    Thanked 2,014 Times in 1,328 Posts

    Default

    Quote Originally Posted by dfiocch View Post
    US, Russia, Poland, Italy, China...

    Spam bots coming from: ilovevitaly.com, sanjosestartups.com and some other spamming websites.
    I partially solved this issue with a combination of "analytics filtering" and .htaccess blocks.

    If someone need some "tips", I'm here
    This traffic doesn't have a referrer though, it's just suspiciously spammy direct traffic that I can't figure out the point of....

    Also means I don't think it can be blocked as there's no identifiable feature.
    onlinegamblingwebsites.com - Formally known as goodbonusguide.

  12. #12
    dfiocch's Avatar
    dfiocch is offline Private Member
    Join Date
    September 2006
    Posts
    878
    Thanks
    789
    Thanked 567 Times in 350 Posts

    Default

    Quote Originally Posted by baldidiot View Post
    This traffic doesn't have a referrer though, it's just suspiciously spammy direct traffic that I can't figure out the point of....

    Also means I don't think it can be blocked as there's no identifiable feature.
    I see the referrers (posted in my previous post).
    At this point, someone is directly spamming your stats code

  13. #13
    baldidiot is online now Private Member
    Join Date
    January 2010
    Posts
    4,441
    Thanks
    409
    Thanked 2,014 Times in 1,328 Posts

    Default

    Quote Originally Posted by dfiocch View Post
    I see the referrers (posted in my previous post).
    At this point, someone is directly spamming your stats code
    Yeah I know about the ones you've mentioned and also get those, but what I meant is this is something new I'm seeing that doesn't have any referrer - it's marked as direct.
    onlinegamblingwebsites.com - Formally known as goodbonusguide.

  14. The Following User Says Thank You to baldidiot For This Useful Post:

    dfiocch (29 May 2015)

  15. #14
    TheGooner's Avatar
    TheGooner is online now Private Member
    Join Date
    March 2007
    Location
    New Zealand
    Posts
    4,264
    Thanks
    1,953
    Thanked 4,214 Times in 2,005 Posts

    Default

    As I understand it - any visits that are marked as no referrer are probably direct.

    If it's a large string of pages done at the rate of 2/3 per second then it will be a spammer or scraper bot that has collected a large list of your pages from a previous visit. Now that it has a list of pages ity checks all the pages directly.

    If you have the ip address you will be able to reverse IP check and you might come up the the server farm where the bot originates and can then block that IP address if you want.

    Typically amazon aws is a prime source but I also found a new one today at a place called Nobis technology (Ip range 23.105.54.*)

    I track several pages on my site (a mix of stats recording an honeypot tracking) and will find 2-3 or these new bots a week and block them to stop future scraping.

  16. The Following User Says Thank You to TheGooner For This Useful Post:

    -Shay- (30 May 2015)

  17. #15
    xecutable's Avatar
    xecutable is offline Private Member
    Join Date
    March 2011
    Location
    Zurich, Switzerland
    Posts
    1,734
    Thanks
    532
    Thanked 1,034 Times in 592 Posts

    Default

    Saw that too, apparently a Russian bot or something cause the address showed up as 4webmasters or something like that. I usually logcheck on Wordfence and just ban the IP or the whole IP range.

    Feels like sometimes i should block a whole country, but then again, what's the reader's fault that 99% of the bots come from his particular country.
    Gambipedia.com - casino & slot reviews accompanied by casino betting guides

  18. The Following User Says Thank You to xecutable For This Useful Post:

    TheGooner (30 May 2015)

  19. #16
    pettersson is offline Public Member
    Join Date
    April 2015
    Location
    zuid-holland
    Posts
    11
    Thanks
    0
    Thanked 3 Times in 2 Posts

    Default

    I have seen similar traffic in one of my sites. I think that in my case its some new spider/crawler that GA is not filtering out.

  20. #17
    universal4's Avatar
    universal4 is online now Forum Administrator
    Join Date
    July 2003
    Location
    Courage is being scared to death...and saddling up anyway. John Wayne
    Posts
    28,123
    Thanks
    2,255
    Thanked 7,948 Times in 5,015 Posts

    Default

    My guess is that a lot of the traffic that does not include a referral are a combination of hackers looking for admin logins as well as spam type bots, Most of these would use port 80 and likely fake their user agents so as to appear to be real web traffic.

    If anyone considering blocking by IP or subnets, let me know and I'd be happy to help you figure out the subnet blocks, although I rarely block much on the web servers unless the ip's are extremely bad actors.

    Keeping mail and dns on different servers has great advantages in cases such as these.

    Rick
    Universal4

  21. #18
    wettFORM.AT's Avatar
    wettFORM.AT is offline Private Member
    Join Date
    February 2013
    Location
    Austria
    Posts
    459
    Thanks
    6
    Thanked 62 Times in 53 Posts

    Default

    I noticed some more direct traffic but I am not sure what the reason was. I canīt find any spam links pointing to my site but the visits were definitely over the average without any reason.
    WETTFORMAT
    https://wettformat.com
    Wett Tipps, Wettanbieter, Wettbonus

  22. #19
    baldidiot is online now Private Member
    Join Date
    January 2010
    Posts
    4,441
    Thanks
    409
    Thanked 2,014 Times in 1,328 Posts

    Default

    Quote Originally Posted by TheGooner View Post
    As I understand it - any visits that are marked as no referrer are probably direct.

    If it's a large string of pages done at the rate of 2/3 per second then it will be a spammer or scraper bot that has collected a large list of your pages from a previous visit. Now that it has a list of pages ity checks all the pages directly.
    Could be scraping I guess, although all of the traffic only ever hits the homepage.



    Quote Originally Posted by xecutable View Post
    Saw that too, apparently a Russian bot or something cause the address showed up as 4webmasters or something like that. I usually logcheck on Wordfence and just ban the IP or the whole IP range.

    Feels like sometimes i should block a whole country, but then again, what's the reader's fault that 99% of the bots come from his particular country.
    Unfortunately every single visitor is a different IP spread across 20+ countries so it would be difficult to block... I might delve deeper into my logs though and see if there are any kind of patterns.




    Quote Originally Posted by universal4 View Post
    My guess is that a lot of the traffic that does not include a referral are a combination of hackers looking for admin logins as well as spam type bots, Most of these would use port 80 and likely fake their user agents so as to appear to be real web traffic.

    If anyone considering blocking by IP or subnets, let me know and I'd be happy to help you figure out the subnet blocks, although I rarely block much on the web servers unless the ip's are extremely bad actors.

    Keeping mail and dns on different servers has great advantages in cases such as these.
    That's an interesting suggestion, I hadn't thought of it being connected to hacking. Will keep a closer eye on it.
    onlinegamblingwebsites.com - Formally known as goodbonusguide.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •