Weird traffic spike - any ideas why?

[Dave McM]

One of our sites had a strange traffic spike yesterday, where we received about twice our current usual daily traffic (nearly 4,000 instead of nearly 2,000).

I couldn't see any reason for it. At one stage I thought we were benefiting from a topical link on a major national newspaper's website, but a bit of digging showed that that link had only sent us five visitors.

In the end it turned out to be 1,800 visits from Bangladesh, allegedly by 1,300 different visitors, all of whom had apparently visited the site's home page only.

Some supplementary info:

• Many of the visits were by Firefox clones (CometBird, SunDial), which from the sound of it are akin to some of the more nefarious browser add-on bars;
• They're still going on today, although I've managed to block most of the relevant IP ranges;
• There's no AdSense on the home page. I did wonder if they were somehow trying to exploit our site to gain AS revenue, but I can't see how that would work.

Any ideas what might be going on? It's got me baffled. Unless, of course, it's just an attack - but why focus on Bangladesh in particular to conduct it? It makes it very easy to identify fresh IPs.

[grynge]

A bot master may have compromised a large bangladeshi isp or network. It could be a test of your hosts infrastructure, it could have been a mining operation gone wrong, it could have been a spamming operation gone wrong. it is really hard to say. Not all bot masters are equal and it could have been a script kiddie learning the ropes.

[Dave McM]

Thanks, Grynge. That makes a lot of sense. For what it's worth, it seems to be several different Bangladeshi ISPs.

Touch wood, I've got it down to one or two an hour at the moment - GA is showing our hourly stats as being very similar to what they were the day before yesterday.

[aneil4lom]

Hi, are there any downsides to a traffic-spike like that?

[grynge]

Thanks, Grynge. That makes a lot of sense. For what it's worth, it seems to be several different Bangladeshi ISPs.

Touch wood, I've got it down to one or two an hour at the moment - GA is showing our hourly stats as being very similar to what they were the day before yesterday.

I can't say for sure with Bangladeshi but some ISP's go under different names, and/or different reverse ns details as well. I remember years ago (before the internet) 1 virus writer I think from pakestani put his virus on all the pirated software he sold. It could have been something similar a common Bangladeshi software was infected and maybe everyone downloaded the new version at once.

Hi, are there any downsides to a traffic-spike like that?

They use your bandwidth to start with
If it is spamming/scraping/vulnerability bot, they are looking for ways to use your server in one of their scams.
So yeah it can cause you problems, they could just be trying to do a DOS (Denial of Service) attack on your server/host.

[aneil4lom]

Thanks, Started doing some reading about Bots last night. Figured it might come in handy in the future.

[Kay]

Hi, are there any downsides to a traffic-spike like that?

In addition to all the possible downsides which grynge has explained, one might also ask if there are upsides to this extra traffic. I would say no, unless you're working on a pay per page view system of advertising. In which case you could make more money because these people in Bangladesh were all looking at your site. But that seems like an unethical way to treat those who pay to advertise on your site.

See this thread about false 'likes' on Facebook - not exactly the same thing but on the same extra numbers theme.
http://experienced-people.net/forums...es-in-Facebook

Also, some people like John Chow and Vic Strizheus preach that traffic equals money. Do you believe that?
http://experienced-people.net/forums...ll=1#post50829

More traffic isn't always better for the site. More customers would be nice.