Tech: Is my website being attacked?

Subject: Tech: Is my website being attacked?
From: GUEST,Jennifer
Date: 19 May 04 - 01:25 AM

In the early hours of this morning there have been 68 hits on my website which recently has been getting about that number for the whole day. Most of them seem to be from the UK, coming from different links and search engines, so why are they all up in the middle of the night looking for John Tams? A lot of them are using Windows XP, so is there some weird virus going round which is causing their computers to go a wandering or is it a deliberate attack on my site to try and boost the numbers so my provider says I'm getting too much traffic? Should I pull the site?
Help!
Jennifer

Subject: RE: Tech: Is my website being attacked?
From: Mark Cohen
Date: 19 May 04 - 01:48 AM

Jennifer, if you can wait until John in Kansas wakes up, he'll probably be able to give you the answer.   I don't know anything about running a website, but you might try the Symantec (Norton) site to see if you can learn anything about what's going around. They may also have a way of checking your server, or client, or host, or whatever you call that thing that does whatever it does to make a website.

Aloha,
Mark

Subject: RE: Tech: Is my website being attacked?
From: JohnInKansas
Date: 19 May 04 - 04:58 AM

Afraid I don't have much to offer on this one. I don't have experience with operating a website.

If you're getting hits from search engines, you may be getting the UK location of the search engine rather than the location of the person doing the searching. Time zone differences could make the hits come in at almost any time, so it's a matter of where people are who are looking. 03:00 in the morning UK is about 9:00 pm in my zone, and US people would span from 7:00 to 11:00 pm or so.

For most people, prime surfing times are in the morning just before going to work, the first couple of hours after arrival at work (for the sneaky ones), just after getting home, or for a while before bedtime. Pick a time, and see if you can find a time zone where one of these fits; and it might give a clue to the real originator's locations.

There are a number of recent virus/worm things that use the address book on an infected machine to fake return addresses and to get addresses to send themselves to, but the common ones usually limit themselves to email hits, rather than site visits. Several recent worms have targeted specific sites for "distributed denial of service" (DDoS) attacks, but the targets are usually major software companies and/or antivirus software sites. A DDoS attack that generates less than a few thousand hits per hour would generally be considered a shameful failure.

People do play games with links to other sites in an effort to raise their own likelihood of appearing in search engine results, so there's the possibility that someone has linked to you. Sites with a lot of links tend to be reported as "hits" by some search engines, so some sites try to cram in as many links as possible.

The people who do this "semi-phony" (call it gratuitous) linking often have "favorite" sites to steal links from, so one link could pop you up on several sites when the others copy the link. Being linked by several other sites can sometimes drastically "improve" your position on some search engines.

A few hits in a short span of time could just mean that someone posted an interesting comment, or asked an interesting question, on some discussion site and people are looking it up. It's not uncommon here at the 'cat to have a dozen or so people admitting that they've been looking for the same info all at the same time, and possibly twice as many others may have looked but didn't comment because someone else got there first.

In short, there are a number of possible reasons for a sudden "bump" in the number of hits that are plausible, and not any cause for alarm. There are no recent reports of "significant" virus/worm activity that seem likely to target a site like yours. It certainly would be advisable that you watch what's happening on your site more carefully than usual for a while, perhaps; but I don't know of any reason to believe that you're being targeted by anything that's been reported recently.

Of course, I only know what's in the newspapers I get.

John

Subject: RE: Tech: Is my website being attacked?
From: GUEST,Jennifer
Date: 19 May 04 - 06:22 AM

My tracking stats give an isp, or server, or something, for what it calls "unique visitors", well I know they're not unique because the same ones come up again when they've reset their cookies. But I've always understood that to mean that if someone is identified by host81-155-130-239.range81-155.btcentralplus.com for example, that means they're getting their internet from BT and therefore in the UK. And today's batch are all different but many UK ones. Sally Tams now says she put out a press email yesterday, which would have been people in the UK, so maybe press people in the UK surf in the small hours! It's on 90 for today now which is the highest I've ever had, but not out of control so I'll hope it's genuine.
Thanks for the reassurance!
Jennifer

Subject: RE: Tech: Is my website being attacked?
From: JohnInKansas
Date: 19 May 04 - 06:39 AM

Jennifer -

I did think about mentioning I was surfing at 04:00 am local, but my hours are so odd that might not be too reassuring. The web, truly, never sleeps.

John

Subject: RE: Tech: Is my website being attacked?
From: Dave Bryant
Date: 19 May 04 - 10:23 AM

Jennifer - which time zone are you in and how does it relate to our UK time zone ?

Subject: RE: Tech: Is my website being attacked?
From: GUEST,Jennifer
Date: 19 May 04 - 10:59 AM

Greenwich Mean Time (well, British Summer Time). Sorry, should have mentioned that. It's up to 109 now, all sorts of sources. Maybe he's going to be famous!

Subject: RE: Tech: Is my website being attacked?
From: Geoff the Duck
Date: 19 May 04 - 11:27 AM

What you don't tell us is what kind of information your web site contains. There is probably some simple explanation for a bunch of visits. Perhaps somebody found information they were interested in and posted the address. Perhaps somebody asked a question, and your site happens to contain two or more words we would use in a search for a relevant link.
Do you not want people to visit your site?
If you do put os a blue clicky here!
Quack!
Geoff the Duck.

Subject: RE: Tech: Is my website being attacked?
From: GUEST,Peter from Essex
Date: 19 May 04 - 05:46 PM

If the visitor does not accept cookies then every refresh will count as a new hit. I have known people enter my site four or five times from the same Google search before now.

Check where you are ranked on the searches used, you may find that Google loves you and makes you the No1 site for John Tams.

Subject: RE: Tech: Is my website being attacked?
From: GUEST,.gargoyle
Date: 19 May 04 - 08:14 PM

Kewl...Kash-Inn....Kwik....Kid

I like your approach....create an aire of mystery....my guess is your traffic has quadrupled in the last 14 hours....as 127 mudcatters go searching for you...and the now notorious John Tams.

Well Done!

I applaude you.

Sincerely,
Gargoyle

Subject: RE: Tech: Is my website being attacked?
From: GUEST,Jennifer
Date: 20 May 04 - 01:16 AM

I guess it may have made it worse, yes. I feel guilty for mentioning it now. But it was the initial surge in the early hours (mine and it seemed the people who were visiting) that puzzled me, and yes Google does like the site but it's been mentioned here before and not caused 149 hits in one day from a recent average of 50 or so.
Sorry sorry sorry. Forget about it.
Jennifer

Subject: RE: Tech: Is my website being attacked?
From: GUEST
Date: 20 May 04 - 04:16 PM

Don't let Gargoyle under your skin, Jennifer. He lives for it.

A

Subject: RE: Tech: Is my website being attacked?
From: Dave Wynn
Date: 20 May 04 - 07:23 PM

Jennifer, 200 hits in a day treat as welcome. 2 Billion in an hour is a DDOS attack. (Distributed Denial Of Service). The bots would be sending massive ICMP pings to take your ISP off the air not just hundreds. Rest easy , password your index and all FTP files and you will be safe.

Spot.