4

A page in my domain is getting sudden spike in direct traffic. All of them are from Moscow, new users, and have 100% bounce rate. I suspect they are spambots:

I have implemented actions from How to Identify Unnatural Spikes of Direct Traffic in Google Analytics, activated Cloudflare's Bot Fight Mode as well as improved the security level:

Still, I don't know their motivation behind this. Some of my questions:

  • Why do they spam by directly access it? Because that leaves no info about them beside the spike. At least a referral traffic contains the domains they want to promote.
  • Why do they access only a particular page? Why not the homepage? And how do they know that page?
Improve this question
3
  • 1
    Maybe that page allows (or allowed) a redirect in the URL or to capture user data (xss attack). Also linking to reputable pages may increase their SEO in some circumstances...
    – Osvaldo
    Apr 10, 2022 at 9:32
  • the page doesn't redirect to anywhere. Can you elaborate on the xss attack?
    – Ooker
    Apr 10, 2022 at 11:22
  • 1
    An XSS attack is when the attacker can execute code on your site by passing a script and data in the url www.yoursite.com/?malicious_code
    – Osvaldo
    Apr 13, 2022 at 20:47

1 Answer 1

Reset to default
2

You need to look at that traffic and at that page better. Is that page a 404? does that traffic have 0 conversion rate and 100% bounce on that page?

If so, then the url has completely no significance to you, it's likely a part of the site the spammers are trying to advertise by having you google that request or something similar. Moreover, if you go and open your access log, you won't see the hits to that page except your own. Bots don't need to go to your site to send spam to GA.

I heavily doubt the possibility of an xss there, especially if it's a generic 404. This kind of bot traffic is pretty common in GA world.

Anyhow, more investigation is needed, but I'm 90% sure it's completely harmless and virtual.

Improve this answer
6
  • The page the spambots accesses is a survey form, not a 404. I guess because of that the likelihood of being xss'ed is higher?
    – Ooker
    Apr 19, 2022 at 12:43
  • well, yes. Technically, it is higher. Somewhat. Not just xss. Maybe they're trying to exploit some vulnerability of that survery form. Or are exploiting. Still, it's very odd that they would be seen in analytics. It's pretty trivial to not send any analytics hits.
    – BNazaruk
    Apr 19, 2022 at 20:52
  • Isn't that any hit that trigger the GA script suffice to send analytic hit?
    – Ooker
    Apr 20, 2022 at 3:36
  • it is, but why would you let your bots trigger scripts that you don't need to be executed?
    – BNazaruk
    Apr 20, 2022 at 19:51
  • 1
    Anyhow, if you want to investigate it deeper, you could actually go and check your access logs. If you don't see these hits there, then you know they're completely fake and nothing to worry about.
    – BNazaruk
    Apr 21, 2022 at 3:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.