Wednesday, February 05, 2014

Blog Invasion - Trying To Figure Out What's Going On

Yesterday I had, according to Sitemeter,  744 hits. (Google Analytics says 1,192 which is about normal for them).   Sitemeter had been showing around 225 to 300 individual hits a day, sometimes more, sometimes less. Here's what the last seven days look like.  There were already 33 hits in the first half hour after midnight today. 

That's a pretty noticeable spike.    Below is today at 12:30pm.  I already have more hits than all of yesterday.  (Yellow are discrete visits, orange are page views)

Normally, when I get a spike like this, it's because I've put up a post that gets a lot of hits from links on other blogrolls, or some high profile website(s) has linked to a post.   That's not the case here.

A lot of the hits were coming from Bulgaria, Romania, Venezuela, Poland, and Spain, but also Greece and Turkey.  They were going mostly to posts that haven't been looked at in months.  There would be spurts of three or four hits on the same  few post in a ten minutes, sometimes within two minutes, then it would be on to other posts.  

There are old posts that get hits everyday.  Usually ones I never expected would become so popular over time - Alaskan Seemantham, How to Grow Tamarind Seeds, Fruit fly or Fungus Gnat? for example.  But yesterday people were hitting posts that just haven't been visited very often since they were originally posted, and many would seem to have limited appeal to Bulgarians or Poles. 

What's going on?  I don't know, but I thought I'd post this in case others are experiencing things like this.  Or if someone knows what's happening.

  • Has google changed its algorithm?
  • Is my blog being taken over by hackers?  
  • Has sitemeter started reporting differently?

One particular post will suddenly get hits.  Then it fades away and another post gets the action.  Posts that have lain there unviewed for months.  Why is this happening?  Why these little clusters for a short period on one post and then a new one on another post.  It's like bees coming to one flower and sucking out the nectar and then moving on to another.

Does this have anything to do with another puzzling sitemeter reading?  The user, Feb. 2, was identified as Carlson and Partners in New York.  But the time was Alaska time rather than Eastern time and the eight pages on my blog it went to were the same pages I had gone to at about the exact same time.  Did Sitemeter mix up my search and their info?  Or had they invaded my computer and somehow followed me?  They're an advertising firm, but there's not much available about them today.  The company's founder, from what I can tell, Sandra Carlson, was closely connected with Ralph Lauren and had that account until she died in a car crash in 2003.  After that, I can't find anything. Not even a company website. 

I noticed once before that an advertising agency, Edelman, that had Anglo-American as a client, had visited a Pebble Mine related post..  And I've read that Edelman monitors the internet for their clients and even post comments.  I got a comment on that post not long after the Edelman hit that sounded suspiciously like a company flack hit job.

Here's the kind of thing I'm seeing:
Greece  1:45
Turkey   1:45
Indonesia 1:46 

Here's what things looked like between 2:02pm (Alaska time) and 2:32pm yesterday.  I've left out eight hits that looked normal (I could see search terms or the links that got them here and they were all US or Canadian time zones.)  I do get various foreign hits every day, but these patterns are strange. (I also added in a couple before 2:02 that went to the same pages.)

From 2:02pm  to 2:32 pm

Venezuela 2:02
(There had been one from a Polish computer at 1:51, one from Chile at 1:53, one from Spain at 1:53;)

Venezuela 2:06
Venezuela  2:10pm
Romania  2:11pm

Thai  2:06pm

Greek language 2:02pm 
????  - 2:07  11 hour time difference

Mexico 2:07pm
UK (Brighton) 2:10pm
(There'd been one from Brazil at 1:55, and a French language one at 1:58)

Italy 2:08

Italy 2:08
Italy 2:10
Romania 2:13
(there had been one from Spain at 1:47pm and Venezuela at 1:48 ?)

Turkey 2:13pm
Brazil  2:22 

???  2:18  11 hour time difference

Venezuela 2:13pm
Venezuela 2:26 ?
Bangkok  2:18
Says USA, but the computer language is Russian and there's an 11 hour time difference 2:25   
(There had been one from Spain at 1:51pm)

Serbia 2:23 
Tunisia 2:32

????  2:12   9 hour time difference
Macedonia 2:29 
(There'd been a Spanish language (es 41) at 1:54pm)
  I did check the IP addresses of some from Venezuela and as you can see they don't match, though two are really close.

Am I just being paranoid?  Is it just a mistake at Sitemeter?  Should I just be happy that suddenly my blog was discovered?  Or is someone messing with my blog?  

So, anyone have any ideas what's going on?  As I post this at 3:22pm I already have 962 hits today.  


  1. Well, for me, I was doing research on Sullivan, Dan s., when I came upon your site. Then I saw all of the gooddies included on the right side of your page and earmarked you for further research. I really take to your style of writing and look forward to seeing more of your wisdom nuggets in the future!

    1. Anon, thanks for dropping by. I have to say that as I read your comment I was looking for a link to some commercial site. The spammers use your style in the comments. But yours is specific to this blog and there's no link. That's one of the side-effects of the spam commenters - I'm skeptical about real commenters. So thanks!

  2. I work in the field of fraud detection and identity theft. While there could be and probably are perfectly innocent reasons for what you're seeing, many of the countries you mentioned (with the exception of the UK) are countries where there's a fairly large amount of credit card fraud going on. If so, these people could be testing your site to see if it's vulnerable, so that they can "gopher hole" through your IP. Check your site security.

    1. Thanks, the clarifies for me a possible reason for all that and that I need to get the Blogspot folks to check it out. I also found this post
      Detect Hacking Attempts with Google Analytics. It's a little old, but it gave me a better sense of what might be happening and ideas about what to do. But your comment makes the possible intent clearer. Thanks.

    2. You're welcome -- anything to help one of my favorite blogs and bloggers!

    3. Wow! Thanks. I think I need you. Could you please email me? Link is at upper right above the blog archive.

  3. I had the same issue happen in 2012, a steady influx of hits that eventually peaked at around triple the average number visits. As with your observations on What Do I Know, it was to bizarre and obscure old posts. No discernable reason or cause, as I wasn’t any funnier or (in)famous than usual. I attributed spammers – not in a malicious hacker sense – but just bots scouring the web for blogs to glom onto via backlinking.

    When in “Edit Post” on the right-hand side is a list of “Post Settings” at the bottom of which is “Options” – and I selected “Don’t Allow” for backlinks, as that is one way spammers hijack traffic to boost their own numbers, esp. if commenting is limited to registered users.

    You might have already done this, or it might also not be the issue, but when I nipped that option the counter plummeted back to normal.Worked for me, worth a quick check maybe?

    Good luck – it’s a bothersome issue.


Comments will be reviewed, not for content (except ads), but for style. Comments with personal insults, rambling tirades, and significant repetition will be deleted. Ads disguised as comments, unless closely related to the post and of value to readers (my call) will be deleted. Click here to learn to put links in your comment.