Abnormal Spike in Traffic- Ddos or what?
-
We've noticed a 100% increase in our traffic over the last three days. However, the page views have not increased proportionately. The traffic sources seemed to be dispersed naturally. Could this be a Ddos in the making or some other type of attack as it seems unlikely that we suddenly started receiving thousands of extra visitors. Its a leading news website with a consistent heavy traffic daily which just doubled over the last three days. What should we be looking at?
-
As you have looked at the traffic sources and they seem to be natural I would then look at what the visitors are doing on your site.
Is the bounce rate up considerably? Has the time per visit fallen dramatically?
If not, if the traffic seems to be coming from a natural spread of sources and the behaviour on the site of the visitors is normal then just be glad of the extra traffic.
-
That's the thing...after a drill down, everything seems very natural...the IP sources are varied, the traffic sources have propotionately increased and the mapping also shows an increase in traffic from diverse locations. Analytics does not seem to indicate a particular planned trend...though the spike in traffic still feels a bit odd!
-
That's the thing...after a drill down, everything seems very natural...the IP sources are varied, the traffic sources have propotionately increased and the mapping also shows an increase in traffic from diverse locations. Analytics does not seem to indicate a particular planned trend...though the spike in traffic still feels a bit odd!
-
Depending on your analytics package you should be able to look at information such as network and location of visitors and drill down into them to see if the traffic is coming from an unusual source. For example on a UK site I look after with a small local focus they have had a number of visits from Tawain via the Taiwanese Google site. This may give you some insights as to whether it seems to be a real bounce or something more sinister.
-
Have you looked into the server activity log ? You may check the referer, the IP used and more. If this is a well done DDoS your servers should be down. Check the traffic : does the increase is a direct traffic ? Does it comes from search results or referring sites ?
A DDoS has only one goal and will probably use a direct request. I doubt this is the case for your site.
Got a burning SEO question?
Subscribe to Moz Pro to gain full access to Q&A, answer questions, and ask your own.
Browse Questions
Explore more categories
-
Moz Tools
Chat with the community about the Moz tools.
-
SEO Tactics
Discuss the SEO process with fellow marketers
-
Community
Discuss industry events, jobs, and news!
-
Digital Marketing
Chat about tactics outside of SEO
-
Research & Trends
Dive into research and trends in the search industry.
-
Support
Connect on product support and feature requests.
Related Questions
-
Spammy traffic
Hi guys! There has been an unusual amount of traffic to one particular page on our blog. Now that the business is slow, I had the time to look into it. Half of that traffic is coming from India and we are a Chicago based limo service. We 'll skip why that happens part for now.
Reporting & Analytics | | echo1
I let Hotjar record 100 session and upon reviewing them I have noticed a lot of sessions with no interaction, no mouse movement, no clicks; just scroll and exit. My question is related to implementing a type of verification (captcha) for that blog page to see if the bots / behavior changes.
Are there any downside in terms of in page SEO for this type of implementation?
What is good practice for something like this?0 -
Filter Remote Workers Traffic
For the most part in the past our company has worked on location. So filtering internal traffic was as simple as filtering out our company IPs as well as a few remote workers IPS. Now a large number of employees are working from home due to Covid-19. I am seeing an uptick in traffic that is clearly employee-related. I am hoping some of you who work with large remote teams may have some suggestions on how to best filter out traffic from remote working employees. I found a few articles from a couple of years ago where people were using a cookie but not sure we can get that implemented in time as our Dev team is backed up. Any help is much appreciated.
Reporting & Analytics | | RMATVMC0 -
How to filter out traffic from subdomain using regex?
Hi There, We have a test server that lives on a subdomain which we'd like to filter out in Google Analytics. We're using the hostname filter but are having trouble understanding the regex needed, we're using this as the filter pattern: .domain.com. Will that work? The profile is new so we can't test the pattern. Any pointers in the right direction would be much appreciated. Cheers Ben
Reporting & Analytics | | cmscss0 -
Loss of Google referral traffic after server move / CMS move
I have a client that changed from MoveableType to Wordpress. He also changed from a dedicated server to WP Engine. He may have blocked search engines for a week or two, so his organic traffic is down but only by 25%. He's 301 redirecting all of the old pages. The mystery is that his referral traffic from Google is down 90%. It's a popular blog, so that's thousands. It's been going on a month now. Anyone seen this before?
Reporting & Analytics | | Hyper-Dog0 -
Organic Traffic down after WordPress switch.
I recently switched our company's website over to Wordpress in February. Organic traffic went down.... http://www.screencast.com/t/dJ0Oeyma5Xs Same content, there are a few different page URLs but most of all it is all the same and I've SEO'd it to pieces. Any thoughts? I can't figure this one out.
Reporting & Analytics | | SteveZero120 -
See which Google TLD organic traffic is coming from in GA
Hi all, I'm working with a client that is marketing to English speaking ex-pats in Thailand. I have a suspicion that many of these ex-pats are searching through google.com (or .co.uk) instead of google.co.th. In Google Analytics (or any other tracking tool), is there a way to see which country-specific Google domain organic searches are coming from? Thanks, Tim
Reporting & Analytics | | TimKelsey0 -
Direct Traffic Source?
Hi all, Having some trouble figuring out a metric I'm dissecting. We have a large amount of traffic going to deep pages and I'm looking at the traffic source and an alarming amount are coming as Direct traffic. The thing is this can't type in or bookmarked traffic, so what else could it be? We have numbers like 80% and 60% for direct traffic, which judging by our previous efforts, that just can't right. Anyone can figure out what I may be missing out? Deeper pages should usually not get as much Direct traffic, so what can it be?
Reporting & Analytics | | William.Lau0 -
Google News traffic spike mystery; referring URLs all blank, Omniture tags didn't fire.
Our content is occasionally featured in Google News. We recently have had two episodes where this happened, but (a) nearly all the referring URLs were blank, and (b) our backend logs show 3-4x more requests for the article in question than Omniture does. In other words, hundreds of thousands of visitors requested a URL from our site (as proven by the traffic logs), but don't seem to have come from Google News (because HTTP_REFERER was blank), and didn't execute the onpage javascript tag to notify Omniture of the pageview. Perhaps this has nothing to do with Google News, but it is too strong a coincidence that the two times we were on there recently, the same thing happened: big backend traffic spike that is not seen by Omniture. It is as if Google News causes browsers to pre-fetch our article without executing the javascript on the page. And without sending a referring URL. Has anyone else seen anything like this before? Stats from the recent episode:
Reporting & Analytics | | mcglynn
- 835,000 HTTP requests for the article URL (logged by our servers) - these requests came from 280,000 distinct IP addresses (70% US) - the #1 referring URL is blank. This accounts for 99.4% of requests. Which, in itself, is hard to believe. These people had to come from somewhere. I believe browsers don't pass HTTP_REFERER when you click from an SSL page to a non-SSL page, but I think Google News doesn't bounce users to SSL by default.That said, we do see other content pages with 70-90% blank referring URLs. Rarely 99+% though.0