Unexplained spike in Direct Traffic since May 19th

[GoogleCodeExporter]

Problem description:    
Unexplained spike in direct traffic since May 19th (+118,57%). Extra visits 
only generated by users that visited the website through Internet Explorer. The 
quality of the gained traffic is way below average in comparison with the data 
before May 19th:

Most important consequential Internet Explorer user, direct traffic results:

% Change (May 12th- May 18th versus May 19th-May 25th):
Total Visits direct traffic:    +118.57%
IE user direct traffic:     +175.62%

IE user pages/visit:        -44.46%
IE user avg. time on site:  -59.81% 
IE Bounce Rate          -11.70% 

Increase in Visits per IE version:
IE 8 +168%
IE7  +253%
IE9  +100%
IE6  +231%

Checked facts:
-No corresponding peaks and/or drops in other traffic sources or campaigns
-The increase in direct traffic is scattered over loads of different landing 
pages
-No emails or links in emails were sent around May 19th
-No documents were sent around May 19th
-No new links (javascript/flash/other) were created around May 19th
-No new pages were added to the site around May 19th

Website situation:
Our client redirected the main domain to a subdomain (in November 2009) which 
serves as a hub page where visitors can choose whether to visit the Classic 
View or the renewed view. The hub page and classic view share the same GA 
account but the renewed view has its own unique GA account. The described 
problem only occurs in the GA account of the renewed view section of the 
website with no redirects in it.  

Probable causes:
On May 18th Google released an updated version of the GA log files:
http://code.google.com/apis/analytics/community/gajs_changelog.html

Could it be the updated log file causing the issue here? I’ve checked the 
accounts of multiple other clients and they don;t seem to display any peaks or 
drops around May 18th.

Expected output:
I hope that someone can help me defining the cause of the sudden increase in 
Direct Traffic. All tips and tricks are welcome

Thanks in advance!

Original issue reported on code.google.com by analytic...@gmail.com on 29 Jul 2011 at 8:44

[GoogleCodeExporter]

I've got a sudden direct traffic spike in my website as well. 15th Sep. All at 
10:00hrs from Japan, Shibuya. All using Firefox. 

Original comment by daryll...@gmail.com on 21 Sep 2011 at 9:02

[GoogleCodeExporter]

We've also experienced an unaccounted for sustained spike in direct traffic 
since May 1st, 2011. Direct traffic 

Feb-April: (direct) ((none))12,047  21.08%
May - July: (direct) ((none))57,569     46.39% 

There were no site enhancements or marketing initiatives to explain the 
increase. 

Original comment by stubbsje...@gmail.com on 29 Sep 2011 at 4:07

[GoogleCodeExporter]

I am experiencing the same issue.  It started after I ran a test on 
http://fpt.pingdom.com/.  I have used this site many times in the past without 
issue but they have updated to v2.0.  Has anyones traffic gone back to normal?

Original comment by rodrigue...@gmail.com on 28 Oct 2011 at 1:33

[GoogleCodeExporter]

I've seen the same thing except mine began spiking on Nov. 28, 2011 and has 
continued since then as of Jan. 9, 2011. If anyone finds a cause beyond sudden 
email popularity or IE issues, please share. I saw the same direct traffic 
trend in Firefox. 

Original comment by kristin...@gmail.com on 9 Jan 2012 at 8:29

[GoogleCodeExporter]

We are experiencing a similar issue.  The signature we are seeing is: Direct, 
New Visitors, Windows, Internet Explorer, landing on 1 of 3 pages, 100% bounce 
rate. There is an even 1/3 split between the three landing pages across all 
200,000 visits we have seen so far that match this signature even though each 
visitor only visits one page. There is no dominant network they are coming 
from. Geography wise it is primarily english speaking countries. It started out 
strong from Canada then shifted to mainly from the US (all cities and states). 
The spike is also showing on Quantcast and in our Apache access logs so it is 
unlikely that is unique to Google Analytics tracking code.

Original poster, I would be interested to know if the more narrow signature we 
have identified in our case also matches what you saw (or are still seeing).  
Also has the traffic subsided? I am wondering how long this will last. Our 
started on Jan. 26th and is still going.

Original comment by pe...@zimris.com on 12 Feb 2012 at 2:33

[GoogleCodeExporter]

We are experiencing the same thing. Bookmarking this thread.

Original comment by becky.ch...@gmail.com on 19 Feb 2012 at 6:24

[GoogleCodeExporter]

I am experiencing the same as comment 5. I did not notice the Canada start, and 
our new "traffic" is limited to two pages (a 60-40 split). Everything else 
Comment 5 described is the same with us.
Mine started on 2-22-12 and is still happening.

Original comment by mountain...@gmail.com on 24 Feb 2012 at 1:14

[GoogleCodeExporter]

Ditto.  Experiencing the same thing.  Started on 2-18, same symptoms.  

Original comment by mpe...@grist.org on 2 Mar 2012 at 7:34

[GoogleCodeExporter]

I might add that we have confirmed via other means (other analytics tools) that 
the spike represents real traffic -- it appears to not be a mirage. 

Original comment by mpe...@grist.org on 2 Mar 2012 at 7:35

[GoogleCodeExporter]

Same here. They are buying our products and filling out forms, so at least a 
percentage of them are real humans. They also seem to be from all over the 
globe. The odd thing is that they average 7 seconds on the site, and before we 
had that huge influx of direct traffic, our average time spent on site was more 
than two minutes. We didn't make any dramatic changes to our site, so it's 
puzzling. 

Original comment by kristin...@gmail.com on 2 Mar 2012 at 9:06

[GoogleCodeExporter]

I just posted a summary of the problem here for those interested:  
http://stkywll.com/2012/03/02/annoying-cyborgs-attach-distort-analytics/

Original comment by mpe...@grist.org on 3 Mar 2012 at 12:23

[GoogleCodeExporter]

Read this post:
https://groups.google.com/a/googleproductforums.com/d/msg/analytics/BsZ41iF2iFM/
qW9nBG6M80oJ

Looks like a DoS botnet (that has also installed FunWebProducts toolbar).

I am waiting for ISP disable this, and AV to update. 

Original comment by phildpea...@googlemail.com on 3 Mar 2012 at 10:16

[GoogleCodeExporter]

I've the same problem. But I think isn't a Google Analytics Issue... I think 
it's a big DDoS attack. I hope that Google can investigate on it to help us to 
resolve this problem

Original comment by maxbo...@gmail.com on 8 Mar 2012 at 4:04

[GoogleCodeExporter]

We have the same but both IE and Firefox. 

Original comment by webmas...@hiscox.com on 23 Apr 2012 at 1:47

[GoogleCodeExporter]

This started February 21st for me...It's going only to my homepage, bounce-rate 
is 100% and they stay for less than a second, browser is always IE.

The attached screenshot shows the spike in traffic.

Original comment by oseym...@gmail.com on 15 Jun 2012 at 10:36

Attachments:

• GA-Phtoto.jpg

[GoogleCodeExporter]

[deleted comment]

[GoogleCodeExporter]

[deleted comment]

[GoogleCodeExporter]

We had the same problem.  Majority was coming from IE and our direct traffic 
doubled/tripled.  In our case, we traced it to a performance scanning service 
such as Neustar/Keynote etc.. They were scanning certain pages every minute.  
They actually render the page in IE to produce their reports so the GA tracking 
code got rendered, but they obviously aren't a real user so no conversions.  
Just filter their IPs out of your GA profile or detect their User-Agent string 
and skip rendering the GA code to them.

Original comment by josh.del...@realtruck.com on 16 Jul 2012 at 6:20

[GoogleCodeExporter]

How did you track back the source of this traffic?

Original comment by jav...@moviepilot.com on 10 Oct 2012 at 3:29

[GoogleCodeExporter]

[deleted comment]

[GoogleCodeExporter]

I believe I was looking at the browser breakdowns in GA and noticed IE hits 
magically spiked around the same time our direct traffic increased.  I dug into 
our web server logs and found a handful of IPs using IE that made a lot of 
regular requests (one every minute).  I took the IPs and ran them through 
arin.net and it was confirmed they were our scanning provider.

Original comment by josh.del...@realtruck.com on 10 Oct 2012 at 3:55

[GoogleCodeExporter]

OMG ! there must be something wrong, I am also getting sudden huge traffic on 
my website, All visitors are  from SAN JOSE (USA) all visitors are DIRECT and 
accessing 1 page for few seconds and closing session, all are using SAFARI 
browser . I am monitoring this on Google Analytic's Real Time monitoring tool. 
this started on 25th Oct 2012, I am really shocked to see this. 

I suspect, there is something abnormal, may be any competitor of me has done 
something to increase my site's bounce rate and this will affect my SEO. Can 
any one help me PLEASE to find root cause and fix the issue ??

Original comment by dipsfree...@gmail.com on 25 Oct 2012 at 12:27

[GoogleCodeExporter]

Look at your web server logs.  Certainly they contain your answer.

Original comment by josh.del...@realtruck.com on 25 Oct 2012 at 1:00

[GoogleCodeExporter]

Today, I noticed a spike in direct traffic, the traffic is from India, Japan, 
and Ireland. I am not sure why either. Our usually is alot less.

Original comment by berner.m...@gmail.com on 13 Nov 2012 at 4:26

[GoogleCodeExporter]

It was Internet Explorer, Windows, New Visitors and the landing page of the 
site. Those were the stats that stood out.

Original comment by berner.m...@gmail.com on 13 Nov 2012 at 4:29

[GoogleCodeExporter]

Has anyone actually got to the bottom of this issue yet? i have been having the 
same problem for months, all with direct traffic, i have searched around online 
and no-one seems to have found a solution?

Original comment by i...@unitedbikeco.com on 3 Dec 2012 at 4:32

[GoogleCodeExporter]

In response to comment 22, this could explain your issue: 
http://searchengineland.com/ios-6-change-google-traffic-from-safari-135002

For the rest of us, I'm at a loss. I've see the same trends for my sites, 
starting back in May 2012.

Original comment by caleb.r...@golocalinteractive.com on 3 Jan 2013 at 3:44

[GoogleCodeExporter]

[deleted comment]

[GoogleCodeExporter]

[deleted comment]

[GoogleCodeExporter]

Somehow I'm here to join the party too... I'm also getting massive direct 
traffic from San Jose - USA, Browser : Safari v533.3, network name : 
gpotato.net, they are increasing daily... they are now in hundreds, I don't 
know what to do...

Original comment by shopz...@gmail.com on 13 May 2013 at 1:05

[GoogleCodeExporter]

I just started a new website in March 2013 & over the last week I have noticed 
a large number of hits from *GPOTATO.NET* - these have come, so far, from San 
Jose, Austin, Texas, and even Indianapollis, Indiana.  All are similar - they 
spend several minutes (9-17 minutes) on each of my pages.
As this is a new website, I've only been getting a handful of hits each day and 
have been trying to figure out how to best grow my site.  I've been watching 
Google Analytics to see how my advertising is working - and then I see this 
strange activity pop up.
I've seen in other conversations on the web that some people have experienced 
the same activity from GPOTATO.NET and that it had been followed by a dramatic 
decrease in normal traffic for people that had previously active websites.
As my site is new - and I've been working hard on it - I don't want anything 
detrimental to happen (but don't really understand *how* a bot can steal 
traffic).
Should I be concerned?
Other than interfering with how my traffic reports reflect actual traffic - can 
this bot do any damage?
What I know is...
Browser type: safari
Network domain: gpotato.net
Operating System: Linux
Traffic source: Direct

Original comment by kian...@gmail.com on 30 May 2013 at 7:55

[GoogleCodeExporter]

I, too, am noticing this same trend of San Jose, Austin, and Indianapolis, all 
of which use Safari, coming on the site for one page at a time. Will this 
affect our SEO and should this be a concern?

Original comment by jShrov...@iprocuredirect.com on 24 Jun 2013 at 5:27

[GoogleCodeExporter]

Did somebody find a solution for this problem? I have a same "SanJose" problem 
but not from gpotato.net mine is psinet inc. Will this affect my seo?  It's 
really annoying pls help! 

Original comment by laslone...@gmail.com on 26 Jun 2013 at 5:50

[GoogleCodeExporter]

The traffic on my site (from gpotato.net) stopped on June 1st. That was after 
about five days of numerous hits on each page, about 200-300 page visits per 
day.

I've searched for explanations and posted on several threads such as this - but 
really found nothing more that what has been said on this thread.

So I have no idea what that was - but not a single page visit from them so far 
in June.

Original comment by kian...@gmail.com on 26 Jun 2013 at 11:17

[GoogleCodeExporter]

i already added the analytics code to my website page  
http://www.officialgt.com/trampoline/  but it still says no tracking code 
installed 

Original comment by official...@gmail.com on 6 Sep 2013 at 2:10

[GoogleCodeExporter]

We saw a sudden spike in traffic that we weren't able to explain until we 
determined our traffic was being double counted because we had portions of our 
site in Iframes. My strong recommendation for anyone experiencing that boost in 
traffic that can't be linked to a specific IP address/server is to check that 
your site does not use iframes. If so, remove them and see how it affects your 
numbers. 

Original comment by kristin...@gmail.com on 6 Sep 2013 at 4:43

[GoogleCodeExporter]

Or just don't put google analytics code in the iFrame.  That would work too
:-)

Original comment by matt.pe...@moveon.org on 6 Sep 2013 at 4:45

[GoogleCodeExporter]

We experienced this on the company's car dealership specific sites for 
http://www.cochran.com. On certain days, traffic spiked to 5x times the normal 
rate. From this thread, I can ascertain that the sites were being monitored by 
a 3rd party system...or maybe something else.

Original comment by CochranA...@gmail.com on 9 Sep 2013 at 1:40

[GoogleCodeExporter]

i have no idea how traffic increase dramatically in a single day without any 
efforts, today 18th sept, 2013, I checked traffic of a my client's website and 
what can I see? I see same as image attached by(#15). my website is based on 
Travel Affiliate Business.
I am also excited to know about its cause. Please explain how it measure.
Thanks
Sandeep Thakur 

Original comment by sandy88...@gmail.com on 18 Sep 2013 at 4:34

[GoogleCodeExporter]

I set monitoring on a new website yesterday that is for testing.  I am 
registering 281 hits for just a few seconds from a test server that we know has 
had no traffic.  

Are these sites published and I need to change a setting or is this an error?

Original comment by ltt...@alaska.edu on 25 Sep 2013 at 9:44

[GoogleCodeExporter]

Experienced the same sharp increase of ghost visitors to our renewed web sites 
http://www.maximilianos.com and http://www.maximilianos.nl. Strange enough the 
also renewed web sites http://www.maximilianos.de and 
http://www.maximilianos.it do not suffer from this problem. It is a problem as 
Analystics does not give usable results for the affected web sites. Another 
website that was affected since 2 days is elastictimetheory.com. Is there any 
response from Google?? 

Original comment by zwa...@gmail.com on 5 Oct 2013 at 8:04

[GoogleCodeExporter]

I'm encountering exactly the same issue for a new web property in Analytics 
since yesterday (09/10). Anyone know of a fix? 

Original comment by ilse.van...@gmail.com on 10 Oct 2013 at 4:54

[GoogleCodeExporter]

Give me best advice to be done for my women men useful info blog 
http://info-women-men.blogspot.com/

Original comment by d.gargde...@gmail.com on 10 Nov 2013 at 6:13

[GoogleCodeExporter]

same issue on our site (germany) - we do not know why this happens?

are there some news?

Original comment by timo.fal...@gmail.com on 18 Nov 2013 at 11:56

[GoogleCodeExporter]

I also have a traffic spike from San Jose, Safari browser, all unique "visitors"
Affected website runs on the Shopify cloud (www.shopify.com)

My questions, hoping for an answer, are

1. Is this a botnet of some kind?
2. Can it be a (government) company just copying all the products on my site?
3. Does this bad traffic affect my SEO?

Original comment by twanverh...@sprague-europe.com on 21 Nov 2013 at 12:55

[GoogleCodeExporter]

I just got the same issue. Our direct traffic visits increased by 1,000,000 in 
10 days! It started on Tuesday Dec 2. Also, a big chunk of the increase is 
related to the a photogallery 
http://www.idolator.com/7483324/miley-cyrus-strips-for-terry-richardson-again.  
I checked the city, it's all over, it's for desktop and tablet only and it's 
not a specific service provider so no idea :(

Original comment by charlene...@gmail.com on 12 Dec 2013 at 4:46

[GoogleCodeExporter]

Just write – and your voice will come ..
Thanks – Hilary Melton-Butcher
Positive Letters Inspirational Stories
http://indresult.com

Original comment by om774...@gmail.com on 17 Dec 2013 at 11:55

[GoogleCodeExporter]

site the funny picture www.usafunnypicture.us 

Original comment by klachink...@gmail.com on 21 Dec 2013 at 3:40

[GoogleCodeExporter]

site the funny picture http://www.usafunnypicture.us/ welcom 

Original comment by klachink...@gmail.com on 21 Dec 2013 at 3:42

[GoogleCodeExporter]

non si sa ancora niente del perche ci siano questi picchi di visitie dirette da 
san Jose? il mio sito e www.lovesexaffairs.com appena aperto 2000 visite in 4 
giorni grazie

Original comment by gilettog...@gmail.com on 20 Mar 2014 at 6:44