Abnormal spike in visitors/bandwidth

Discussion in 'Traffic Analysis' started by TDavidK, Apr 4, 2008.

  1. #1
    Hello,

    I have a computer weblog that normally gets under 100 unique visitors per day. But yesterday it started receiving hundreds of visitors per hour from a bunch of foreign countries. Now my highest ranked referrer is google translate.

    Some of the keywords AWStats picked up are:
    • "who is the principal villain in the 1844 novel “the 3 musketeers?"
    • "qué diputada fue sorprendida consultando una venta de privalia"
    • "¿qué diputada fue sorprendida consultando una venta de privalia"
    • "diputada fue sorprendida consultando una venta de privalia"

    My website is in English and I don't believe has anything to do with those words (even though I can't necessarily read them).

    I checked my 404 error log and it appears people were trying to view weird directories and files on my server that are not linked from the main site or anything:

    • /_vti_bin/owssvr.dll
    • //sources/join.php
    • /phprojekt/lib/layout/venus/venus.php
    • /ncaster/admin/addons/archive/archive.php
    • /modules/basicfog/basicfogfactory.class.php

    None of these have anything to do with my website. I did read that owssvr.dll is just something FrontPage with some discuss plugin for IE looks for and is harmless. Sorry for the long post, I have searched other places but people don't seem to have too many explanations. This all spiked my bandwidth usage as well.. 1.5GB yesterday from that subdomain alone. Where as I usually only use roughly 100MB or so. The surge in visitors appears to have stopped today however.

    Anyone else notice this weird spike in traffic (with no real results AKA ads clicked, comments posted, etc)?
     
    TDavidK, Apr 4, 2008 IP
  2. TDavidK

    TDavidK Peon

    Messages:
    2
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #2
    I can confirm that a few of the things from the 404 errors are vulnerability scans, checking to see if my website has any security holes
     
    TDavidK, Apr 4, 2008 IP
  3. ShReYaS

    ShReYaS Peon

    Messages:
    1,945
    Likes Received:
    82
    Best Answers:
    0
    Trophy Points:
    0
    #3
    I think these are some traffic bots or some security loopholes in you site
     
    ShReYaS, Apr 7, 2008 IP
  4. manish.chauhan

    manish.chauhan Well-Known Member

    Messages:
    1,682
    Likes Received:
    35
    Best Answers:
    0
    Trophy Points:
    110
    #4
    This could be due to spammy robots...just block them using robots.txt..
     
    manish.chauhan, Apr 7, 2008 IP
  5. munnakv

    munnakv Active Member

    Messages:
    293
    Likes Received:
    5
    Best Answers:
    0
    Trophy Points:
    60
    #5
    One possibility is somebody is trying an automated brute-force attack to find any unprotected directory or hole.
     
    munnakv, May 3, 2008 IP