Need your help with this log...

[fryman]

I met a guy that wants to sell me his site. It is getting over 8,000 daily visitors, and I am getting a really good price for it. However, I asked him for some traffic screenshots, and he sent me this screenshot

Could you tell me why is it showing that over 80% of the visits last 30 seconds or less?

[daboss]

i have a website that gets about 300+ visitors daily. most of the users also stay for less than 30 seconds. i think they got referred in from a search engine (in my case google) and found that the site is not relevant to their search... so after a while they left?

[fryman]

So, do you think they are real visitors? If they are, I don't care if they stay for 30 seconds or less, I will put up a popunder and I'll only need them to stay for 5 secs. to get credit for it

[J.D.]

Originally Posted by fryman

I met a guy that wants to sell me his site. It is getting over 8,000 daily visitors, and I am getting a really good price for it. However, I asked him for some traffic screenshots, and he sent me this screenshot

Could you tell me why is it showing that over 80% of the visits last 30 seconds or less?

I would ask him to provide his logs for at least a week or so - that screenshot may be just a 5-minute HTML work. If he really has this volume, he's going to have logs so big it would be hard to make them up. You can run his logs through your analyzer and get a fair picture of what you are dealing with.

J.D.

[fryman]

Oh, he sent me his complete logs for January and February, that was just a pice I cut off since the page is very large. I just found it strange to see that so many people are staying for 30 seconds and was wondering if he was using some king of bot to inflate his stats, but I guess not.

[GTech]

Another thing you can ask for, is to do a trial on the traffic. Ask him to redirect the domain to your site for a day or two so you can verify the traffic.

I too have a high 30 second rate on many sites. It's not uncommon. Most of mine are between 50 and 70 percent.

[Haichi]

yes I would verify the traffic it is too easy now to generate traffic using Hits services for a month or two

but 30sec is very common

[hans]

if you have full access_log for 2 months with that traffic is most likely some 100+ MB
if you run it through webalizer or similar stat software - then you get
- countries from visitors
- ISP
- referral URL
- key words used in SE
- hourly stat / daily stat ...
etc
and much more
that shoud give you far better picture than what you showed so far
a view on raw access_log shows you instantly if it is fake or real
to fake a log of that size would be lots of work ...

another method would be to have him install ( whoisonline ) access.pl
and to allow you in the browser to view current visitors with referrers, keywords used to fidn page, entry page, etc
it shows from where they come and what pages visitors load before leaving ...
an easy to install script can be found at
http://www.perlprojects.net/

[J.D.]

Originally Posted by J.D.

I would ask him to provide his logs for at least a week or so - that screenshot may be just a 5-minute HTML work. If he really has this volume, he's going to have logs so big it would be hard to make them up. You can run his logs through your analyzer and get a fair picture of what you are dealing with.

J.D.

Hmm, I got a rate-down on this, so I'm assuming it was one of you, traffic-redirection guys rating me down for suggesting on analyzing two weeks worth of logs. Well, while I must agree that two weeks worth of logs is not enough for an exhaustive analysis, traffic redirection isn't as bullet-proof as one might think.

First of all, there are thousands of proxies that one may use to generate traffic for a few days without drawing much attention. Many of them don't even add any proxy-specific stuff and their requests will look just like any other authentic request. Then again, there are thousands upon thousands of hacked end-user machines that may be used for the same purpose. In this case, it is technically impossible to detect that any of these are forged visits.

Getting back to logs, if you have substantial number of logs with enough information (e.g. user agent, referrer; cookies in the log help as well, although most sites don't log cookies) it is possible to tell, with a certain degree of credibility, whether logs were forged or not.

For example, randomly generated log lines will have mistmatched page-to-graphics hits (i.e. you may have 100 hits to a single cacheable page that generated 300 hits to a single picture referred by this page). More serious analysis would look at the distribution of user agent strings - authentic and forged hits usually generate different patterns, as well as such things as time between page hits, graphics hits, etc. You get the idea.

Of course, none of these methods is bullet-proof and buying a website for traffic will always be a gamble to some extent. If I did this, I would do a significant research on the guy's history and I would make sure that the sales contract is drafted so that there's a way out if it turns out after some reasonable time that the site is a dud.

J.D.