Flood of visitors!

Support & Bugs
1

Hi Friends,
I just happened to be looking at my Piwik dashboard, when I noticed a new visitor, from a referer that I get all the time. Nothing out of the odinary. But then another and another and another. All from Finland! All from the same referer. All different system info.

In 30 minutes, the visitor count more than doubled our all time high visitor count. The majority all from Finland, looks like ~75%, but several other random countries sprinkled in.

This can’t be anything natural. It must be some kind of bot. Is this an attack of some kind?

Almost an hour now since it started, and they’re still coming! At first, they were looking through 15 to 20 pages over 2 or 3 minutes. Now most of them are looking at one page and leaving.

My site is very new and still pretty small. We’ve only gone over 100 visitors (by Piwik’s count) twice. It was looking like we would top out around 70 to 80 visits by midnight. The last time I had looked at it tonight, it was in the 60s. But in the last 1 hour it shot up to 220. We’ve had more visits in the last half hour than we ever get, all day! And they’re still coming!!

What is this?? It must be a bot, and I don’t understand why Piwik thinks it’s not. What can I do to have Piwik ignore…whatever this is??

I’m not sure what kind of info you might need. But let me know, and I’ll provide it.

Thank you very much!

2

My Visits Over Time graph literally looks like this:

(attached)

Again, approx 75% are from Finland, the rest from random countries, 100% from 1 referer, random system info, all different IPs. It really can’t be natural traffic.

There must be some way to block this attack, but it’s way over my head. Any help appreciated.

Thanks again :slight_smile:

3

I was looking at some other analytics on my server – Logoholic and AwStats. Logoholic reports a rather low visit count for yesterday, while AwStats shows a typical busy day. But neither one indicates this spike in volume which Piwik reports.

Maybe somethings gone wrong with my Piwik? Maybe it’s mis-reporting?

Thanks again.

4

Hard to say. Maybe look at the visitor log and see if you can spot any pattern in the visitors? do you see any websites bringing you more visits? also please update to 2.2.1

5

It looks like the “attack” or whatever it was, ended about 3 hours ago. I contacted my site host, who didn’t initially see any issues. But I gave them access to my Piwik, so they could see what I’m concerned about. Still waiting for reply.

I’ve looked in the Visitor Log. The only thing in common is Finland, and the Refering Website is always the same. I was thinking about contacting the refering website, and ask them about it, but haven’t done that yet. The Refering Website is not unexpected. I normally get a few visits per day from them (maybe 3 to 8).

They come from all different providers, and different IPs, and the system info (browser, os) actually seems pretty random. Ohh…different providers, but the majority from Finland. There can’t be that many providers in Finland. Maybe I’ll look into that side of it.

Ok, at least half the providers appear to be bogus – their link from the Visitor Log is not found, or the server reset or the connection timed out, etc. But 2 or 3 seem legitimate (I don’t read whatever language Finland speaks.)

Normally I average a meager 70 visits daily (and that’s even a distorted number because I use both js and image tracking). But for yesterday and today, over 300, and today close to 400!!

Some of them hit 1 page and leave, and others look through many pages. No trend there.

Well, now that it seems to have stopped, I guess it’s probably not a broken Piwik. But maybe I should wait until this is resolved, or at least I get more info, before i upgrade?

Anyway, thanks. If I or my host ever figures it out, I’ll let you know. But it’s definitely a mystery, at least for me!

6

Ok, my web host said he thought it might have been “distributed web crawling”. I did find the term in Wikipedia, but I can only vaguely understand it. But he also said he didn’t see any spikes or flags.

And truly, all my other analytics did not give any indication about this. While according to Piwik, my visitor count increased by 500% for 2 days (at least 400% from Finland, and I know that’s not normal), and today maybe only 20%; yet Logoholic and AwStats didn’t see any significant change, as far as I can tell.

So as long as this isn’t going to happen very often, I guess I won’t be too concerned about it. But if it’s going to happen more than say twice a year, it’s gonna mess up my stats!

Is there any reason that this should be looked at more closely. Was it targetted to my site, and if so why? Can it be blocked? What would be involved in investigating more thoroughly? I don’t suppose it would be as easy as sending you a log file or something?

Thanks again :slight_smile:

7

If the number of views remains below several hundred per day, then it would appear to be quite normal and not very alarming, perhaps your site is becoming increasingly popular among a social group within Finland and is resulting in the increased view counts. However, if the view count begins to exceed many hundreds or into the thousands, then it is likely that it is a bot that is resulting in the abnormally high view counts, and I would recommend that you block any ip address that appears to be visiting your website far more than what is expected based on other visitors of your site.

Hope this helps!

8

I think above message is spam.

There doesn’t seem to be any way to report a message for suspected spam.