It all started early this year. Day-to-Day my Google Analytics of a swiss-website (german language) showed me more and more visitors — mainly from the US and France. First, of-course, I was really happy because of the good numbers … but than, after a few weeks of 20%+ new visitors each, I got a suspicious about that sudden rush of new visitors. I digged deeper and looked what exactly do they visit on our page and how long they are on our page … first, they only remain about < 1 Second on our page. And there seams not to be a special site, which they preferred. It looks like they visit random pages, new ones, old ones, popular ones, not so popular ones … and I found out that they are mainly from these Countries: United States, China, France and Thailand.

I tried to filter out those bad «<1s Visitors» from my Analytics-Numbers. This worked quite well, except that I had to re-check the filter just one or two weeks ago, since there was a 10-20%+ new visitor rush again … now there were many new <1s-visitors from Yemen, Belgium and Nigeria too. So the country-list expanded to: United States, China, France, Thailand, Yemen, Belgium and Nigeria

enter image description here

Was it in the beginning of the year «only» about 20% of all logged visits, now there are already 540% more <1s than regular visitors today! … thats massive! They are in the thousands … and they slow down our page massively 'cause of all those additional requests.

Is this a known problem? What can I do against these <1s-Visitors? -> Not only filter them out of my Analytics-Numbers, but to do something against them since they slow down the page massively too.

Some additional Infos (from the stats of the last 7 Days):

  • As Refferer almost all of these <1s-visitors have «(direct) / (none)»
  • And as Hostnames they have: «(not set)» (28,23 %; US), «ovh ltd» (25,59 %; BE), «ovh static ip» (17,06 %; FR), «vps cheap inc.» (14,44 %; YE), «ovh hosting inc.» (12.23%; US)
  • 99,9 % Firefox
  • 99,9 % Macintosh (v10.10)
  • 99.8 % en-us
  • What are the referral sources and mediums for the visits? You can filter them, but if they're from advertisements, you probably don't want to block them.
    – dan
    Apr 17, 2016 at 7:37
  • @dan they're from «(direct) / (none)» … and I'm almost absolutely certain that they're not from adverts, since we did that only for 2 Weeks in January and thats long ago and the <1s-visitors had been there before … and many more came after.
    – albuvee
    Apr 17, 2016 at 7:46
  • ...but it was in about the same time-period it all started and so it's a little susbicious <- seemed they might be related based on that. I'm not sure what we can tell you since we don't know the sources, it could be from bots, hacks, etc... I'd suggest trying to correlate the visits with your server logs, and filter & block those if they don't emanate from your adverts (links from which could still exist in databases).
    – dan
    Apr 17, 2016 at 7:57
  • 1
    OK, we only have what you state to go off of so I'd suggest adding some more information (such as the referrers and what your logs indicate). We have lots of questions here on how to set filters and filter out referrer spam.
    – dan
    Apr 17, 2016 at 8:14
  • 2
    OK, you'll need to collect their IP's from your logs. There are a number of ways to block them. It's unclear if you're hosting multiple sites (i.e., there seams not to be a special site, which they preferred), so my answer here might help in that case, and would work for single sites too. We have lots of other questions here covering this too.
    – dan
    Apr 17, 2016 at 8:56

1 Answer 1


Are you monitoring a PCI certified company? We got the same traffic and the reason was a stress test for the PCI certification.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.