Direct / (none) Spam Traffic Help

[Nivik23]

In July 2015, we experienced an over 1,000% increase in traffic and it has remained like that ever since. It's all spam traffic and I have no clue how to get rid of it. I added in your typical .htaccess blocks from known culprits with little to no effect. Read up on Ghost traffic and applied filters to no effect. The spam is completely distributed as far as I can tell both geographically as well as by network providers. Where once we had pretty decent bounce rates of around 50%, now, since all my Analytics data is meaningless - it's around 90%. I could apply a filter but beyond my GA account providing no insights, I'm also concerned about the increased use of server resources. I'd ideally like to stop the traffic completely.

The only distinguishing feature of the traffic that I have been able to determine is browser size. Comparing June 2015 to July 2015 we saw the following:

Browser size visits:

620 x 460 = 6,828 vs 0, 610 x 450 = 175 vs 0, 1330 x 630 = 71 vs 1, 1890 x 940 = 67 vs 0, 780 x 580 = 58 v 5.

Other than that, I can find no unifying theme to the traffic beyond being traffic hitting our homepage and having no medium. Nothing special that I am aware of happened in July. We didn't do any sort of...really anything. We did have our network compromised by ransomware in the beginning of June, which we promptly ignored and restored backups - at no point did we try to contact the criminals, but I am doubtful there is any connection considering that our website is remotely hosted.

If anyone has any suggestions or has seen anything like this before, please let me know.

spam-traffic.jpg

[Nivik23]

Thanks for your insights John. I was hoping, albeit naively, that there was some overlooked silver bullet that I could apply but it does seem that this issue is not going to be solved by some mystical cure-all. Your suggestion of inspecting the browser size is probably the best bet. Unwanted traffic will still slip through, but I should be able to minimize it quite a bit.

[4RS_John]

This is a tough question. I had something similar happen - a lot of distributed traffic, that wasn't real but looks real-ish. I don't remember the screen sizes we had, but it was mostly old-ish versions of IE.

Since the main action people do on our site is Search, we added a ReCaptcha after people search a certain number of times. We also found some paths the spammers take through the site and created some controls to block, or Captcha, those paths. It's a tough balance, though, because you don't want to ban real users from the site.

Could you use some JS to inspect the browser, then set a cookie? Then your server-side could look for the cookie on subsequent requests and send them to /stop-eating-my-bandwidth-you-jerk.html or a more business-friendly equivalent.