Sudden increase in traffic to my site - Webmaster General forum at WebmasterWorld - WebmasterWorld

Forum Moderators: phranque

Sudden increase in traffic to my site

Wmff

10:42 am on Nov 7, 2025 (gmt 0)

Top Contributors Of The Month

My site is not that popular, if I got 10 visits a week that was about average. Within the past few weeks visits have been averaging about 30 per day.
Is it a botnet, is the user agent string that I see just ubiquitous for Windows 10/11 so this is nothing malicious, is something blocking the referring link, or did my site just suddenly get bumped up in search engine ratings?

Why I am suspicious:
- exponentially more visits
- tracking service reports "No referring link" in majority of following user agent/s
- user agents identical except for chrome version but always in this range, 139.0.0.0-142.0.0.0, sample:
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36
- majority of visits are opening the same 6-8 pages
- most trigger my tracking service script and get recorded but not all
- most from USA but large numbers from Brazil
- besides actually opening a complete page many hits are single hits like these, but from the same user agent/s

2025-11-05
17:11:19
68.41.126.25
GET /index.php/9-uncategorised/1861-snipe-fly-genus-chrysopilus HTTP/2
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36
United States
7028
817

2025-11-05
18:59:28
65.185.0.188
GET / HTTP/2
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36 Edg/141.0.0.0
United States
10953
437

rustybrick

11:54 am on Nov 7, 2025 (gmt 0)

WebmasterWorld Senior Member

10+ Year Member

Top Contributors Of The Month

Does Search Console show the lift too? Or just your logs and analytics?

not2easy

12:20 pm on Nov 7, 2025 (gmt 0)

WebmasterWorld Administrator

10+ Year Member

Top Contributors Of The Month

The IPs shown are residential ISP IPs for Comcast Cable Communications and LLC and Charter Communications Inc. It is not impossible to be part of a botnet that the IP user is unaware of. I would look at the logs to see whether these visits are rendering complete pages or just particular resources (like html without css or images without the html).

The UA can be manipulated and you could see multiple hits from the same IP showing different UAs (in succession) in the case of scripted visits.

Wmff

1:44 pm on Nov 7, 2025 (gmt 0)

Top Contributors Of The Month

rustybrick
Not sure what you mean by "search console". I don't have a google analytics account. My server logs do not show "referrer" data, I have a shared hosting plan with Hostinger. Referrer data (referring links) are only shown in by my tracking service, Statcounter. That happens whenever the script in my site's template is triggered.
That can happen even if someone or something has stored a page somewhere and renders it while connected to the internet.
not2easy.
Visits do occasionally show up at Statcounter but do not show up in my server logs, quite often those are from Brazil.
"visits are rendering complete pages" - it's a mix, there are visits that seem to render complete pages that don't get recorded by Statcounter. There are also visits that only render a single element of a page, as in the samples above. The only common in most of them is the UA.

not2easy

2:39 pm on Nov 7, 2025 (gmt 0)

WebmasterWorld Administrator

10+ Year Member

Top Contributors Of The Month

I haven't seen legitimate referer (sic) data in logs for many years now. Usually when there is a referer link it is bogus, on a scripted bot.

Statcounter gathers more visitor data than logs (referrer/device/resolution/browser) that bots can manipulate for their scripts, so they won't always show the same data.

lucy24

4:57 pm on Nov 7, 2025 (gmt 0)

WebmasterWorld Senior Member

10+ Year Member

Top Contributors Of The Month

Check for one other thing. When a request is for only the page, see if it is immediately followed by all supporting files from an entirely different IP (look especially for 34.34.blahblah).

Visits do occasionally show up at Statcounter but do not show up in my server logs

If it isn't in logs it isn't a visit. Do you mean that they're requesting the analytics file (GA or third party), meaning that they want you to think they've visited? (Statcounter? Seriously?) It's unusual for these not to come with a referer, since this is currently the preferred form of referer spam.

... which reminds me that I�ve been meaning to post about my own robot woes, but it goes in a separate thread.

Wmff

6:25 pm on Nov 7, 2025 (gmt 0)

Top Contributors Of The Month

"(Statcounter? Seriously?)"
Might I deduce from that post that Statcounter is not reliable or are you suggesting something much more negative?
I've been using it for over 10 years, way back when my first web site was just simple .html with no CMS system. I've never really looked at another tracking service, maybe I'm just being lazy.
Statcounter reports do match up with what I see in my server log analytics, UA and ISP.
The only time I find a conflict is when they report "Icloud Private Relay", my server logs almost always show the actual ISP.

lucy24

9:10 pm on Nov 7, 2025 (gmt 0)

WebmasterWorld Senior Member

10+ Year Member

Top Contributors Of The Month

Might I deduce from that post that Statcounter

Whooops! My bad; I was thinking of the similarly named doodad (was it Hitcounter? I forget) that used to live at the bottom of webpages when we were Internet babies.

Seriously, though, if you�re using any kind of analytics, pick one that lives on your own site and is therefore subject to your own access controls. That way you�ll never have someone claiming to have come in when really they never even tried the door.

Still, how odd of your host not to include the referer in access logs.