2

It all started early this year. Day-to-Day my Google Analytics of a swiss-website (german language) showed me more and more visitors — mainly from the US and France. First, of-course, I was really happy because of the good numbers … but than, after a few weeks of 20%+ new visitors each, I got a suspicious about that sudden rush of new visitors. I digged deeper and looked what exactly do they visit on our page and how long they are on our page … first, they only remain about < 1 Second on our page. And there seams not to be a special site, which they preferred. It looks like they visit random pages, new ones, old ones, popular ones, not so popular ones … and I found out that they are mainly from these Countries: United States, China, France and Thailand.

I tried to filter out those bad «<1s Visitors» from my Analytics-Numbers. This worked quite well, except that I had to re-check the filter just one or two weeks ago, since there was a 10-20%+ new visitor rush again … now there were many new <1s-visitors from Yemen, Belgium and Nigeria too. So the country-list expanded to: United States, China, France, Thailand, Yemen, Belgium and Nigeria

enter image description here

Was it in the beginning of the year «only» about 20% of all logged visits, now there are already 540% more <1s than regular visitors today! … thats massive! They are in the thousands … and they slow down our page massively 'cause of all those additional requests.

Is this a known problem? What can I do against these <1s-Visitors? -> Not only filter them out of my Analytics-Numbers, but to do something against them since they slow down the page massively too.

Some additional Infos (from the stats of the last 7 Days):

  • As Refferer almost all of these <1s-visitors have «(direct) / (none)»
  • And as Hostnames they have: «(not set)» (28,23 %; US), «ovh ltd» (25,59 %; BE), «ovh static ip» (17,06 %; FR), «vps cheap inc.» (14,44 %; YE), «ovh hosting inc.» (12.23%; US)
  • 99,9 % Firefox
  • 99,9 % Macintosh (v10.10)
  • 99.8 % en-us
albuvee
  • 141
  • 4
  • What are the referral sources and mediums for the visits? You can filter them, but if they're from advertisements, you probably don't want to block them. – dan Apr 17 '16 at 07:37
  • @dan they're from «(direct) / (none)» … and I'm almost absolutely certain that they're not from adverts, since we did that only for 2 Weeks in January and thats long ago and the <1s-visitors had been there before … and many more came after. – albuvee Apr 17 '16 at 07:46
  • ...but it was in about the same time-period it all started and so it's a little susbicious <- seemed they might be related based on that. I'm not sure what we can tell you since we don't know the sources, it could be from bots, hacks, etc... I'd suggest trying to correlate the visits with your server logs, and filter & block those if they don't emanate from your adverts (links from which could still exist in databases). – dan Apr 17 '16 at 07:57
  • @dan just double-checked: the advertising actually was from 7th to 21th of february. as you can see in the graph above, thats in the midst of this whole thing. I don't deny any connection between these <1s and the advertising-campaign, but these dates show it did not start in the same time. – albuvee Apr 17 '16 at 08:02
  • 1
    OK, we only have what you state to go off of so I'd suggest adding some more information (such as the referrers and what your logs indicate). We have lots of questions here on how to set filters and filter out referrer spam. – dan Apr 17 '16 at 08:14
  • @dan I've edited the question – albuvee Apr 17 '16 at 08:25
  • OK, those are common stats for referrer spam bots - see this for more reports. You'll need to find their IP's and block them in your .htaccess if you feel they're slowing your site down (I'd suggest confirming that's the case first), and see the link in my comment above for filtering them. – dan Apr 17 '16 at 08:42
  • @dan we definitely can confirm that they are slowing down our page — the stats on pingdom and performance-stats from the sever itself show quite impressive correlation when compared to the requests from those <1s-visitors. – albuvee Apr 17 '16 at 08:45
  • 2
    OK, you'll need to collect their IP's from your logs. There are a number of ways to block them. It's unclear if you're hosting multiple sites (i.e., there seams not to be a special site, which they preferred), so my answer here might help in that case, and would work for single sites too. We have lots of other questions here covering this too. – dan Apr 17 '16 at 08:56
  • @dan It's one website with multiple pages (sorry for the mixup of words sites & pages) – albuvee Apr 17 '16 at 10:03
  • Your website's content seems to be of interest to some third party, probably translating and putting it up on some other websites. Sounds to me that your website is being crawled by bots. – Nikhil Mathew Apr 17 '16 at 13:31
  • OVH (and others) are well known spambays. You should block their whole ASN, use a blacklist service like stopforumspam/cleantalk, and/or hook up with something like cloudflare. Also look at fail2ban. There are tons of abuses from the countries you mentioned, but also Russia and Ukraine. You can "challenge" them via cloudflare. That should help, at the least. – dhaupin Apr 18 '16 at 17:53
  • @dhaupin hmm, CloudFlare sounds interesting. Are there comparable services like CloudFlare – do you know any alternatives to CF? – albuvee Apr 20 '16 at 16:28
  • @dhaupin we tried out CloudFlare for the last two days … did not work. it does ban a few dozen requests, but there are thousands of bad requests that should be blocked … so CF did not work. – albuvee Apr 23 '16 at 15:02

1 Answers1

1

Are you monitoring a PCI certified company? We got the same traffic and the reason was a stress test for the PCI certification.

Stephen Ostermiller
  • 98,758
  • 18
  • 137
  • 361
Gernot
  • 11
  • 1