Strange traffic sources in my stats reports every day

trader

Verified User
Joined
Sep 1, 2005
Messages
39
Location
USA
Odd traffic sources in my stats reports every day, possible fraud or traffic theft?

Regarding one of my websites which every day gets lots of suspect traffic, and I have no idea why the traffic arrives from these 3 major traffic sources. When I look at both my AWstats and Weblizer stats I see these in my logs consistently:

cronjob.de - about 3000 visits (listed under both Hosts & Links)
localhost - about 7000 visits (listed only under Hosts, not Links)
jlussi.de about 4000 visits (listed under both Hosts & Links)

I went to CronJob.DE and its a German language site so not sure what the site is about or its service, anyone know? I tried translating it using Alta Vista Babelfish but the translation fails for some odd reason. Also never heard of cronjob.de website before and not even sure what localhost is?

Also visited JLussi.DE and it looks like a small German women's beauty products store, which I never heard of before. No, we do not have link arrangements between my sites and jlussi (or cronjob.de) and if we did that much traffic from them would be hard to believe anyway (my site is an old image storage free host site and not related to a German Cronjob or womens beauty site).

I am wondering if there is a connection between cronjobs.de and jlussi.de since they are both in Germany and both by far the 2 top URL's in my logs? We have no connection to Germany and never heard of either url or read German, and both sites are in German language, so it is real odd. In addition, noticed CronJobs.de and Jlussi.de both use large amounts of my server Bandwidth, which also seems quite odd.

Somewhat concerned there is some kind of fraud or possibly traffic theft going on here as there is no reason for all this traffic coming from these 2 obscure to me websites. Not sure if this is relevant but about the time I noticed this issue I hired a web hosting website owner in Europe (but not in Germany) to do some work on my site and I am a bit suspect he did something to cause this, especially since before he worked on it the site was getting 5 to 10 times the visits it gets vs after he was done with his work. It still get good traffic but 5 to 10 times less unique visitors than before.

It's almost like my traffic was somehow stolen overnight and I feel these sites in my stats may be a key to understand this. As a matter of fact I hired that hosting expert (who I met at a forum board) to do some work on trying to better use my good traffic (to earn more $ from my affiliate link) and also filter out the loads of free image storage low value sub-domain traffic.

Can someone please guess as to what may be going on here and why my website gets thousands of hits every day from these 3 strange referrer log sources? I have not seen these in my stats from my other sites, only for this site. Thanks.
 
Last edited:
This is not a DirectAdmin related issue and has been moved to Off-Topic Discussion.

Jeff
 
Sorry, I should have realized it was off-topic. Thanks for moving it.

Anyway, can someone who is more knowledgable than me reply as I as really worried about this and have lost many thousands of site visitors but contrarily also used loads of my bandwidth every day since this issue started. Thanks.
 
Last edited:
I have no idea why you're getting hits from certain sites. If you don't want those hits then you should block them either with firewalling or by using hosts.deny. Or if they're approaching DOS status (nothing in your post indicates they are) then you can ask your upstream to do something about it at their routers.

And I don't see the logic that would say if someone is hitting your site, then they'd be stealing your traffic.

Since I don't know how you drive your traffic I don't know how to check to see if it's being stolen.

First I'd make sure whatever advertising you buy is still running properly.

Second I'd make sure your search engine results are still good, as manipulation of search engine results (actually common these days) can keep you from getting the hits from search engines you used to get.

And third I'd check tracroutes from all over the world (you can google for traceroute sites) to see if your DNS has somehow been poisoned.

There are several root servers... you can (preferably) use dig (from Linux or unix) or nslookup (from Windows) to see if the root servers are passing the right DNS information. A good book on DNS can help you learn how to use these tools.

Jeff
 
....And I don't see the logic that would say if someone is hitting your site, then they'd be stealing your traffic.

What I am trying to say is that perhaps the Cronjob.de website (possibly also in conjunction with the other odd German site) is somehow running a Cron Job on my traffic and maybe re-routing it to a 3rd party website who perhaps resells the traffic, or uses it to get affiliate sales.

My site was getting about 10,000 to 20,000 visits/day but after those odd URL's started to appear in my logs the traffic dropped by 5 to 10 fold, down to roughly 2,000/day.

As to where the traffic is/was coming from, as I said before, it's an old free image host site I purchased from the old owner with thousands of old image/photo hosting free users and links too.

P.S. Rather than block the traffic from the suspect sites I prefer to get to the bottom of this and get all the lost traffic back, the high traffic was the reason I purchased the domain name!

Thanks.
 
Last edited:
Trader,

Interesting problem...

Are they all accesses from the same IP or varying IP's ? It could just be faking the domain name.

Also a friend of mine who runs one of the UK's largest online company registration websites found a competitor had got some spyware written (for around $200 in India) that installed a browser hijacker and redirected his visitors to the competitors sites.

If you want to email me your logfiles and a few more details I'd be happy to have a look through and see if I can spot anything.

rob (at) matrixxhosting.com

Rob
 
Trader,

I asked a friend of mine who depends on hits and visits to look at your post; here was his reply to me:
It sounds very odd. I would think it likely that they are harvesting
something from his site. The hits in his log should show the exact files
those sites are hitting. Maybe they're running crawlers. Maybe the person
he hired to work on the site added something in German that attracted a
German bot. As to why his traffic dropped, only someone looking at his
site prior to the traffic drop and now could tell that. Maybe something
was changed in his site to make it less search engine friendly. Did he
convert to Flash content? Frames? If he dropped off of Gooogle or Yahoo,
that would explain the drop in traffic.
I hope this helps you.

Jeff
 
Back
Top