4 ms·

Back in July, hundreds (thousands?) of sites noticed a surge in traffic in their analytics. Hundreds to thousands of additional visits per day above their norma

Back in July, hundreds (thousands?) of sites noticed a surge in traffic in their analytics. Hundreds to thousands of additional visits per day above their normal traffic rates. Curiously, all this traffic identified as Internet Explorer 7 on various version of Windows, but each visit came from a different residential IP, and viewed only one page per session. Eventually the common thread between all these sites was identified -- they had retargeting tags from sites like AdRoll: http://www.thesempost.com/adroll-retargeting-bot-attack-behind-ie7-traffic-surges/ http://www.thesempost.com/adroll-retargeting-bot-attack-behi... For months now, huge botnets have been producing huge amounts of fake web traffic, picking up retargeting cookies in order to later be served ads and have whoever's behind the network paid for those views. That surge has never ended. It's only grown (including becoming less easy to spot), yet nobody seems to be talking about it anymore, including the retargeting companies. I'd love to know who's behind it and how they control so many computers.

throwaway20148 12y ago
Sometimes this stuff isn't even bot traffic, it's traffic purchased from someone who fulfills by incentivizing people who play online games with virtual currency for viewing videos or clicking through to sites that serve the buyers ads. I presume they've also got into the retargeting capture game, too.
- JeremyMorgan 12y ago
  Yup. Many facebook games have a "watch this video" or "visit these sites" in an iframe in exchange for extra points, more seeds, a better pool stick, etc. Just as useless as bot traffic.
hagbardgroup 12y ago
SV will not care about this until another 2000-level crash. Then, they will be forced to care, because the revenue will stop coming in. Until then the community will do the see no evil / hear no evil / speak no evil routine.
ljk 12y ago
Maybe some kind of malware in the form of toolbars that sneaks into other downloads by the non-tech-savvy users?
- netrus 12y ago
  There are a thousand more or less easy ways to pull this, but it is hard to stay unnoticed at this scale. You'd guess that every plugin/toolbox/freeware used by hundreds of thousands of people is running on some test-boxes/honeypots set up by security companies/browser-vendors.
seba_dos1 12y ago
Recently (during last two weeks or so) a lot of such suspicious traffic started appearing in Google Analytics as various versions of Internet Explorer, not only 7. We were forced to filter out IE completely to just calculate stuff like conversion rate. Great that legitimate traffic from IE was negligible anyway, but who knows how much of this traffic is still hiding there as some other browsers? Thankfully, as far as I know we don't do any retargeting campaigns right now (but I think we did in the past, and we were targeted by those IE7 bots in July as well), but it's still awful PITA to deal with it in analytics data. So, I'm seconding your comment completely.
shostack 12y ago
Hats off to them for a genius attack. Wow. Retargeting was definitely ripe for abuse. This underscores the importance of getting MUCH smarter and pickier with your audience lists and how you actually define them and value their contribution to a given conversion.

throwaway20148 12y ago

Sometimes this stuff isn't even bot traffic, it's traffic purchased from someone who fulfills by incentivizing people who play online games with virtual currency for viewing videos or clicking through to sites that serve the buyers ads. I presume they've also got into the retargeting capture game, too.

JeremyMorgan 12y ago
Yup. Many facebook games have a "watch this video" or "visit these sites" in an iframe in exchange for extra points, more seeds, a better pool stick, etc. Just as useless as bot traffic.

hagbardgroup 12y ago

SV will not care about this until another 2000-level crash. Then, they will be forced to care, because the revenue will stop coming in. Until then the community will do the see no evil / hear no evil / speak no evil routine.

ljk 12y ago

Maybe some kind of malware in the form of toolbars that sneaks into other downloads by the non-tech-savvy users?

netrus 12y ago
There are a thousand more or less easy ways to pull this, but it is hard to stay unnoticed at this scale. You'd guess that every plugin/toolbox/freeware used by hundreds of thousands of people is running on some test-boxes/honeypots set up by security companies/browser-vendors.

seba_dos1 12y ago

Recently (during last two weeks or so) a lot of such suspicious traffic started appearing in Google Analytics as various versions of Internet Explorer, not only 7. We were forced to filter out IE completely to just calculate stuff like conversion rate. Great that legitimate traffic from IE was negligible anyway, but who knows how much of this traffic is still hiding there as some other browsers? Thankfully, as far as I know we don't do any retargeting campaigns right now (but I think we did in the past, and we were targeted by those IE7 bots in July as well), but it's still awful PITA to deal with it in analytics data. So, I'm seconding your comment completely.

shostack 12y ago

Hats off to them for a genius attack. Wow. Retargeting was definitely ripe for abuse. This underscores the importance of getting MUCH smarter and pickier with your audience lists and how you actually define them and value their contribution to a given conversion.