Well guess what, boys and girls – THEY'RE BAAAAACK!

On November 12, 2013, the same site that was hit before started showing a huge increase in direct traffic.  It was, on the one hand, very similar to the previous attack, and on the other hand, there were some important differences this time around.

Samesies:

• The site under attack is the SAME site that was hit before – and (so far) ONLY this site has been hit.
• Still not reporting any referrers
• Many ISP and IP numbers from all over the world
• All reporting Windows (XP through Windows 7 – NO Windows 8, and 95% Windows 7)
• All reporting IE browsers (versions 8 and up)
• Still executing javascript (as it shows up in Google Analytics, but does NOT appear to be clicking anything)
• Still a slow drip – never so much as could be considered a DDOS, but just enough to be annoying and stand out.
• Many of the same IP numbers come back two or three times a day.

New and Updated for 2013:

• This time, reporting some mobile sized viewports; previously mostly laptop viewports.
• Last time, the attack only hit the home page of the site. Now it's hitting the home page plus three taxonomy pages.
• Last time they started big, and slowly tapered down. This time (as evidenced by the screenshot below) they started slow, and are ramping up.

Since they're hitting an AdSense site, we're now serving AdSense only to users with some kind of referrer.

It's interesting also to note that they're not hitting any taxonomy pages that were added since the last attack.

Will they suddenly stop on January 12, 2014 having completed their mission? What is their mission, anyway? The site is otherwise perfectly healthy, and performing well in all channels; there's no hacking (nor even hacking attempts) and as far as I could tell the bots weren't even trying to click on the ads (I just took them off to be safe).  I have read about some Windows viruses that hit particular sites over and over looking for some kind of remote control to tell them what to do next, but I'm pretty sure I don't have any such on this site.

Mostly I have no answers; I am just posting this because I got so many responses and emails about the last attack, I wanted to put this out there to see if anyone else was getting hit again too.

Lemme know.

Zombie Bots Part Deux – They’re Back is a post from: Netmeg

I give you Exhibit A:

Which one of you bastids gave me less than five stars??

eBay Says AdWords Doesn’t Work is a post from: Netmeg

I have clients on old ecommerce platforms such as OSCommerce and ZenCart that I would LOVE to move over to WordPress (have you tried to SEO an OSCommerce or ZenCart site? It can be done but it's like three pains in each ass cheek.)

I have a full developers license for Cart66, which I can use for a couple of personal projects, but it doesn't support tiered pricing. This is a basic requirement of ecommerce, and it's positively ridiculous that they don't support it. Moreover, you can't find out they don't support it until after you buy it – the support forums for Cart66 are full of people who have been begging desperately for this feature for over two years – but the forums are only open to people who've bought the product. Megafail.

Jigoshop also doesn't appear to support tiered pricing.  I repeat – nowadays this is a requirement for selling online. Every single one of my ecommerce clients offers discounts for quantity (and always has).

I don't want a hosted solution, such as Shopify or BigCommerce.  We need to be able to self host.

Even going off WordPress – Magento is way overkill for what we want to do. I have one client on a mid sized Magento Enterprise install, and I'm only too familiar with what it takes to run well.

I looked at one from Tribulant, but it has compatibility issues with other plugins (for SEO and caching) that I can't do without.

I tried WP E-Commerce but my clients had a difficult time understanding it (and ultimately they're the ones who have to deal with it). It *does* have tiered pricing, but what it doesn't allow for are add-on accessories that add to the price AND add to the shipping weight.

There are a number of free plugins (such as WooCommerce), and some offer some of the functions I need as an extension for extra money, but I can't test them on my clients products without buying them first, and given my requirements (and the poor experiences I have had trying to shove products into carts that don't fit), I have no idea if they will work even with the extensions.

And NOTHING seems to offer EVERYTHING I need for any one client. So for now, they're stuck on OSCommerce and ZenCart (which isn't very Zen). One of my clients has SEVEN PRODUCTS and four of them won't fit into any WordPress shopping cart I have so far found.

Someone needs to jump on this. There is still room for a paid ecommerce plugin for for WordPress that offers the same features you can find in the old software.

Look, what I need isn't that difficult.  Ecommerce platforms (that aren't WordPress plugins) have had these things for years.

• As mentioned, I need tiered pricing. That means discounts for quantity. Preferably set by table.
• I need the ability to offer price = FREE, but still add a shipping and handling charge.
• I need product variations (with pricing AND SHIPPING WEIGHT options)
• I need to be able to add a handling charge in some situations
• I need to be able to offer coupons, promo codes, and free shipping on some products.
• I need to be able to offer multiple shipping options (we have products from 1 to 500lbs) on a per product basis
• I need to be able to easily create category pages
• I need it to be able to work with PayPal (standard and pro) and Authorize.net
• I need it to work with a live shipping feeds from UPS and Fed Ex (and something in Canada – Fed Ex or Purolator)
• I want it to be self-hosted. Not interested in hosting elsewhere.
• It has to be reasonably easy to integrate – shortcodes are good
• It has to play nice with essential WordPress plugins
• An added bonus would let me export orders into QuickBooks

I have people willing to pay for this. Why can't I find anything that I'm sure will work? Isn't it time to do ecommerce in WordPress like the grownups do?

Shopping Carts for WordPress Suck is a post from: Netmeg

But I ran across something that was a little confusing (to me, at least) and I was unable to find any reference to it in the Google documentation.

When I first set up product targeting, I only put single target in for each ad group; we've been working on refining the feed and now that I have more targets to choose from, I wanted to expand our options for some of our ad groups.

After you've added a product extension to your campaign, and you are ready to add specific product targets to your ad group (the tab marked Auto targets), once you click on the green Add Product Target button, you are presented with a box like this:

Now, if you only have one target for that ad group, or just wish to target all products, everything's easy peasy – you just validate, save and go.

But you're allowed to select from up to THREE product targets, and it apparently makes a difference how you do it.

You see above I've added Blue Widgets.  Now, when I started this project, I didn't even really pay attention to the + Add another link – I took the time to validate and save each target separately. That left me with my targeting looking like this:

After I'd done a few of these (and was looking at doing a lot more), I finally noticed that + Add another link, and thought maybe that would save me some time to add a second and then third target. So that's what I did – I added Green Widgets, then Red Widgets, and saved (note: it won't let you validate if you add targets this way – it just gives you a very unintuitive error message and doesn't explain anything.)

However, once I saved it, my targets for the ad group looked like this (very different):

This gave me pause. For one thing, it wasn't organized like the targets I'd added previously (one at a time). And the way that “and” was there – I was thinking maybe this wouldn't serve the way the other ad group did. Like maybe there was an and/or thing going on here.

But I couldn't find anything written up about in any Google documentation, or the AdWords Help forums, or even searching in Google for it. I needed to know how this worked before I did too many more, so I fired off an email to AdWords Support, and got a quick response from my buddy Karthik (we're old friends now, Karthik and I) which confirmed my suspicion – they are NOT the same!

If you add all three product targets at the same time (using the + Add another link) that means the ad group will ONLY use products that belong to ALL THREE GROUPS. Red AND Blue AND Green. (I'm trying to think of a reason why someone would want that, or set it up that way intentionally, and I can't think of anything. Which begs the question of why Google offers it, or doesn't explain it, but…)

Whereas, if you add your targets one at a time, that functions as an OR statement – and it will choose your targets from Blue Widgets OR  Green Widgets OR Red Widgets.

Maybe this is obvious to everyone else, but it wasn't to me, and I couldn't find any documentation on it anywhere (although Karthik says he's going to send it up to be added to the Help Files) and with Google it never ever pays to assume.

So if you're just starting with this, pay attention to how you add your targets. If you want to choose products from any of up to three product groups, use the first option – each target as its own line item.

(Of course, I haven't yet tried this in the AWE; I'm about to give that a try as well. I am more speaking to the lack of written documentation, and the weird targeting option here.)

AdWords Product Targets – Pro Tip is a post from: Netmeg

If you're going to use it, use it carefully. Test first. Err on the side of caution.

Personally, I don't intend to use it at all. I understand why people want it but… no.

On a related note – do you have any idea how many ex-friends and ex-clients still have me looped into access to their GWT accounts? Access that I myself can't revoke if I wanted to.  If I were an evil person, I could do some *serious* damage.

Time to check who all has access to your GWT. Do it NOW.

Good Link or Bad Link? is a post from: Netmeg

Add sites to ManageWP – Step One

Add sites to ManageWP – Step Two

Add sites to ManageWP – Step Three

Add sites to ManageWP – Step Four

Add sites to ManageWP – Step Five

Add sites to ManageWP – Step Six

Hop on back to the ManageWP review

Adding Sites to ManageWP is a post from: Netmeg

Last week, the WordPress 3.4.2 update was released. My normal routine is to set aside the better portion of a day to back up, then update the WordPress (and plugins), of  the ridiculous number of WordPress sites I maintain for myself, some friends and family, and a selection of clients. Oh and a few sites in various stages of development and yet more sites created just to test stuff.  All told, we're talking a lot of sites.

WordPress Updates x Number of Sites = PITA

As you can imagine, keeping all these sites updated, backed up, and functional is a pain.  And of course, you have to do it. You do keep your sites up to date, right?

Even though I'd heard of tools for managing multiple WordPress sites, I never really considered putting my sites into one. Mostly because I was under the (mistaken)  impression that in order to use them, I would need to change my hosting. I don't want to change my hosting. After horrific WordPress hosting experiences on FIVE substandard hosts, I am more than happy with Tiger Tech; they have better-than-extreme customer service, are optimized for WordPress, and can deal calmly with my weird and drastic seasonal traffic spikes (not to mention my emotional spikes). 98% of my sites and my client sites are in Tiger Tech, and I would prefer they stay there.

This year, we've grown so much and been so busy, it was clear that something had to change. My kick ass developer partner put his foot down, and said we really needed to streamline this operation or we'd fall behind. So at his suggestion, I told him I'd check out ManageWP, but that if it required changing hosting, it wasn't gonna happen.

I was on the site about five minutes before I thought “Where has THIS been all my life?”

ManageWP is a single dashboard that controls all your WordPress sites. It's  extremely easy to implement (you just install a plugin on each site and then add the site to your ManageWP console), you don't have to change your hosting, and with one click you can update all your sites, including themes, plugins, and WordPress itself.

Now, I could stop right there and just having that functionality is worth it for me.  I put eight sites into ManageWP to test, and it took two minutes to update them when the new WP update came out. Let me say that again – two minutes. Doing all that manually is not exactly the best use of my (limited) time.

But Wait – There's More!

(You knew I was going to say that)

Not only can you bulk-update all of your sites in ManageWP, but you can also perform the following tasks from the Dashboard:

• Log in to any site from the Dashboard.
• Perform manual updates on sites (in case you have a tetchy install and don't trust an automated update)
• Install new plugins and themes on a single site or across multiple sites
• Clear out piled up post and page revisions and spam comments
• Administer comments on across all your sites (if you are using native WP comments – I haven't tested 3rd party comments plugins yet)
• Manually back up your sites (full backup or database only)
• Instant restore of said backup for each of your sites if you need to
• Get email notifications anytime updates are available
• Test your sites for malware, broken links and performance issues

And that's just at the Standard starter level. When I signed up, I opted for Pro which also lets me one-click new WordPress installs, clone existing sites, and do scheduled automated backups for each of my sites, and send them offsite (Dropbox, Amazon S3, FTP, Email). I can also add users and sub users (plus restrict access to my ManageWP by IP number) and there are some extra reports and traffic alerts.  (There's something in here about Google Analytics integration, but I'm quite happy with the Yoast Google Analytics for WordPress plugin, so I don't expect I'll need that.)

There's a Business level that I may end up purchasing for clients; it includes some uptime monitoring and white label capability for the plugin that gets installed in each site. There are also some SEO tools, but since I haven't purchased the Business level yet, I can't speak to what happens with that. Plus I already have a subscription for the best SEO Tools on the planet.

If you're dealing with a lot of WordPress sites (even if they're hosted all over the place) ManageWP is a no-brainer. It's already shaved tons of time over almost every maintenance task I have to perform. Plus I can get rid of the slightly buggy backup plugin I actually have to purchase a new license for every year.  In fact, I'm considering buying a Standard plan too, because the dev and test sites don't need the features of the upper level plans, but I'd like to have them all in one place nevertheless.

Other features that are really useful – you can create groups in which to organize your sites, so if, for example, you want to install a plugin or theme on a group of sites (oh, let's say, fireworks sites – ork ork) you can easily do that. Plus you can bulk upload your sites into the Dashboard, either by dragging and dropping files, or uploading a CSV file. I only added eight to begin with, so I did them manually, and it took me less than ten minutes total. But if I were adding 50 or a hundred, I'd definitely go CSV.

(By the way, I took some screen shots of the initial setup to show you how easy it is – check it out.)

And in case you're wondering – even after it's all set up, you (or the people who write for you) don't have to work from within ManageWP. The normal admin still works just fine.  While I detected no performance degradation on my sites after they were hooked into ManageWP, I did find that there was a bit of a lag on the admin side when I was trying to perform writing or editing tasks (or adding events, in my case)  Plus I tend to work on laptops, and I have less screen space working on my admin which is then embedded within the ManageWP admin. So what works best for me is to do all the maintenance tasks in ManageWP and all the creative and editing in the normal WP admin. YMMV. If you right click on something in your site and Open in New Window or New Tab, you break out of ManageWP anyway, so that's pretty painless.

One other caveat – there's a “refresh” option for the Dashboard that can be set to auto refresh when you log in, don't set it. When I would log in to do something quickly, waiting for the auto refresh to check eight sites taxed my patience; I bet it slows incrementally as you add more sites. It's just plain faster if you leave it unchecked and refresh manually when you want an update.

Pricing

You can get the Standard package for up to five sites for FREE.  Yea I said it.  FREE.  More than five sites, pricing starts from $6.30/month for up to 10 sites, to $49.50 per month (for up to 250 sites) billed annually; slightly more if you want to go month to month. This is the one I'll probably use for development and test sites.

The Pro level starts at $10.80/month for up to five sites, up to $148.50/month (250 sites) billed annually, and again, slightly more on month to month. This was my pick, because I like the scheduled (offsite) backups, and the clone/migration capability.

Business packages (with the uptime monitoring and SEO tools) start at $21.60/month for up to five sites, up to $297/month for up to 250 sites, billed annually. I don't anticipate needing this for myself, but I have some clients with mission-critical sites that would probably like the monitoring.

But you don't need to take my word, because you can do what I did and try out up to five sites on the most basic package for free. Took me about three hours to realize I wanted this for all sites under my control.  Probably won't take you half that.  Like I said, this is a no-brainer.

The links in this post are affiliate links, which means I am compensated if you purchase after clicking on them. All of them are goods and services that I use myself, paid full price for, and feel very comfortable recommending. 

Managing Multiple WordPress Sites is a post from: Netmeg

Now, my job is not to get into the philosophical argument of whether or not this transition is a low blow to ecommerce sites,  paid inclusion, or some other scourge; that's already been covered, and by better and more widely read writers than I. My job is to get my clients' products in front of everyone who may be searching for them. To that end, I spent most of this week trying to get several thousand products into the Merchant Center, and there are some serious – serious – problems with the user interface.

If Google is going to push people to pay for these listings, then we need something worth paying for.

I was not a complete newbie to the Merchant Center; prior to this we had a healthy sized product feed going up every week through 2010, but then we changed ecommerce platforms, and hadn't had time to write the new feed until now.  My client had an existing Merchant Center account, and it was already tied to their AdWords account, so that was in place.  I logged in as the client, and added my first test feed.  Once we determined that was working, I uploaded my first live feed, which included 958 products. I created my PLA campaign in AdWords, and set up my catch-all ad group first, so everything appeared to be as it should be. My plan was to get all the products into the feed first, and then fine tune the AdWords bidding later.

Along the way I realized that I could add additional users to the Google Merchant Center. It's a lot easier and more convenient for me to log in with my own Google account, so I added myself as an additional user. Which was great, except that after I did that the client account (which is also entirely under my control)  wasn't sent a notification by Google that someone else had access to its Merchant Center. Uh – SECURITY! Over here!  The User Settings aren't exactly front and center, so it would be entirely possible to miss an unauthorized user with access. Other Google products will notify you of changes to users; it should be included here too.

Even weirder, when I logged in to the account as myself, I got this honking big pink notice – apparently because I had not tied the CLIENT's Merchant Account to MY OWN AdWords account, despite its already being tied to the CLIENT's AdWords account.  Got all that?  Essentially, it's not smart enough to realize that every user on the account doesn't want the products tied to their own account.

If I log in as the client, I don't get any error message. I went back and forth a few times – error / no error / error / no error.  D'oh.  I bopped over the Product Forum to report this, and was told by a top contributor there that it was safe to ignore the error message.  Since I was told this exact same thing by an AdWords rep about a false error message in my AdWords account as well, let me put this in all caps for you: NO IT IS NOT SAFE TO IGNORE ERROR MESSAGES EVEN WHEN THEY ARE FALSE, WERE YOU NEVER TAUGHT ABOUT THE BOY WHO CRIED WOLF?  If my accounts get clogged up with false error messages, then I don't find the real error messages when they happen. Fix the fake error messages, please.

Also, the $100 credit is a nice offer, and almost might have made me feel better if it hadn't expired on August 15, 2012. Today is August 30, 2012.

But okay, my products are in place, and they all look dandy.  Except wait.  The product screen only shows me 50 products at a time.  I can't expand this to 100 or 500 lines; it's just 50. I have 958 products total so far, so that's twenty pages to thumb through if I want to look at one particular product. This is really going to be a pain when I have 3500 products.

Oh well, I'll just search for it. Except I can't. There's no search. There's just a Lookup by ID box at the top and bottom of the field. They are referring to the product ID field that was included in my feed, but which does not show up on this screen. In order to get the Product ID, I need to click on the Product link.

I need to say this again.  I can't use the the Product ID to find a product until I find the product and click on it to get the Product ID.  Or I can go find my original feed file on my computer, and look it up there. By this time I'm aware of a dull pain behind my eyes.

Maybe I can click on the column headings, and sort it that way, that might help.  Nope.  Not one of the Product Headings is clickable; there is no way to sort this list of products.

Wait a minute.  What's that hazard sign doing in the Product Ads column? Mousing over it, I get a label that says “Product Ads: Disapproved or Invalid.”  I click on the link, and it tells me the same thing: Product Ads: Disapproved or Invalid.  It doesn't say why. And I still have green check marks for this product under Product Search (Searchable) and Search API for Shopping (Searchable).  So for some reason it's available in the feed, it's searchable in Google Shopping, but it's not eligible for a paid ad.  I scroll through a few more pages (50 products per page – grrr!) and I notice a handful of these symbols. Since I am not given even a hint as to what is wrong with these products, I would really like to look at them all at once, to see if maybe I can see some common characteristic that would clue me in as to why they triggered the symbol. But of course, I have already determined that I can't sort on the Product Ad column. Wait a minute! There's a little filter dropdown in the upper right corner! Maybe that will do it. It takes almost a full minute to search through 958 products (did I mention that everything about the Merchant Center is about seven times slower than every other Google product, even AdWords??) Problem is, none of the dropdown options appears to apply to my situation. I am offered All, Active, Inactive and Searchable.  The product is included in All, and Active.  Google says I have NO Inactive products at all.  Selecting Searchable appears to make the disapproved item go away, but it just gives me all my APPROVED items – do I really have to count them all out and figure out what's NOT there?

And just to add insult to injury – you're gonna love this – after I run the Searchable filter, look what it says at the bottom here:

HUNDREDS? Seriously, Google?  You couldn't even give me a COUNT?  W. T. F.

Sigh.

Over on the Product Forum, I see other people have gotten these disapproved ads messages too, and they are advised to take it up with AdWords. Ok, I will do that, but don't you think it would be more efficient if you gave me a way to grab all of them at once, instead of feeding them to Support one product at a time?

I need to get this wrapped up because writing blog posts is not my thing (obviously) and I have other stuff to do today. So I won't elaborate on how Google wants you to use a field called adwords_labels to target your PLA bids to specific groups of products – but if you DO use this field, they don't display it in the interface; nor is it available in your AdWords account so you can easily target it.  Basically the only way to do any of this is to keep your original text file feed open and loaded in Excel at all times while you work.

Nor do they give you the option to just EXPORT the data they have, so you can look at it and sort it any way you want. If I had that, I could even find all my disapproved ads.

The thing to remember through all this is that I have so far only put in 958 products. This client has about 3500 total. But even that is pretty small potatoes. What do the people with 10,000 products, or 50,000 or 500,000 do? Do they have access to some interface or API I don't get to see, or are they struggling with this as much as I am?

I have been saying the same thing over and and over to Google (and Microsoft) for ten years, and it's just as true now as it ever was.

I have NO budget constraints.  If this channel provides reasonable ROI (and we believe it will), then I can instantly get approval to spend twenty times my monthly budget with you. We've had a good history with AdWords and Google Product feeds. We want to up our game.  We're willing to pay to do it. The one thing we don't have is unlimited time to spend on it. The easier you make it for me to use your products, I guarantee you, the more money I dump in your everlovin' corporate lap. WHY are you making it so difficult?

I'm sure there will be more once I start targeting bids. Stay tuned.

Google Merchant Center – One Hot Mess is a post from: Netmeg

One of my sites has been under mass attack by bots for a month now, without cease.  It's cost me (and my developer partner) time, money, and an undue amount of stress.  It's undermined my analytics and stats.

It Just. Keeps. Coming.

And while there are a couple things we've been able to do to minimize the damage, essentially there's no way to stop it. It just. keeps. coming. And frankly, if it continues, and spreads, there could be big repercussions across the web on ad revenue and analytics.

What I Know

The attack started on February 21, 2012, around noon.  I keep an OCD-level eye on my traffic, and I noticed a big jump in direct traffic.  This is unusual, because this particular site is less than a year old, and has not had a chance to develop a lot of branding yet.  It's pretty well situated in the search engines for its niche, but not that many people know it by name.  Anything more than twenty or thirty percent direct traffic would definitely be odd.  And then I started noticing some other strange behaviors:

• All the traffic was reported as Internet Explorer (versions 6 through 9)
• All the traffic was reported as Windows (XP through Win 7)
• The traffic was coming from all over the world (and the site is focused on ONE state in the US) and from thousands of IP numbers & ISPs.
• It was all hitting the home page and leaving immediately.  My bounce rate quickly soared to about 99%
• There was nothing – no one thing – that I could pinpoint to block this traffic from coming in. No commonality.
• It was executing javascript – because it showed up in Google Analytics, Statcounter & Woopra.

Strangest of all, the traffic was *slow* – drip drip drip.  Never so much to come anywhere near a DDOS, or have an effect on the server, but at any given point, there would be six to ten “visitors” on the site at a time.  While it looked very much like actual human browser traffic, it wasn't difficult to conclude that this was something automated.

What I Don't Know

The first thing I did was turn off my AdSense.  Any kind of automated traffic like this would (quite reasonably) be seen as a risk to advertisers, and I had no idea what this was or what it could do. I turned ads off on the entire site. After several days when it was obvious it was only hitting the home page, I could turn the ads back on for everything BUT the home page.

That same afternoon, Roger Dooley  posted a thread on Webmaster World about the same sort of bot attack on one of his own sites. Over on the Google Analytics help forum, a discussion was forming with more and more reports of this same strange traffic pattern.  Most (but not all) started on February 21.

The first thought that went through my head was that I was somehow being targeted (paranoia!)  But if someone really wanted to attack me, they probably wouldn't have done it on this site.  Comparing notes with as many people as I could find, there seemed to be no commonality on the receiving end – some sites had AdSense, some did not. Some sites were WordPress, some were static HTML.

Then I thought, maybe it was some kind of a probe, looking for a WordPress exploit.  But other (non-WP) sites were being hit.  Harvesting email addresses? I don't list any email addresses on that site, and besides, all this was doing was loading the home page, over and over and over.

More paranoia set in – maybe someone who got Pandalyzed and wrote something to trash Google Analytics, and I was unwittingly part of the beta test?  After all, Google gets a lot of aggregate information from GA; trashing the stats like this would definitely damage trust in the product.

But whether it was a targeted attack, a coding error, or collateral damage didn't matter. What mattered was that I might have to shut down my site. It's a community service event site, and it's supported by ad revenue, both Google's and (hopefully) direct local ads.  I couldn't run AdSense on a site with bogus traffic, and it would be fairly difficult to sell direct advertising without decent stats to show potential advertisers.  And this particular site sucks up a LOT of resources when it's at peak; it needs to be able to pay for itself.

Like I wouldn't notice that.

I asked my host, TigerTech, to take a look, and they said as far as they could tell, it looked just like human traffic. There were no User Agents or anything else by which we could block this traffic (without blocking real live users)

After a week or so, Roger posted a theory that perhaps Compuware's Gomez Peer program (which pays users to install a screen saver that tests site and network performance, and collects benchmarking information) might be behind it.  Some people had reported contacting Compuware and the traffic mysteriously stopped.  But I contacted them, they opened up an investigation and determined that my site was not in their database, and the IP numbers I sent them were not part of their peer program. They also told me that Gomez identifies itself in the User Agent.  I have no reason not to believe them.  (And the people who said their traffic had mysteriously dropped jumped the gun – it came back.) So that was a dead end too.

I did a lot of frantic Googling for other people having the same problem, and we tried a lot of things, none of which ended up panning out.  Bill Atchison (@IncrediBILL) of CrawlWall put a lot of time in as well, making suggestions, writing scripts to collect data, and so forth.  In the end, he came to the same conclusion as everyone else – it was browser traffic. There was no way to 100% block it without blocking real human users.

Where I Am Now

As of today, March 20, 2012 it will be four weeks since this attack started.  It's still going on.  It's still a slow drip, and it's gotten a lot slower on my site, although other people are reporting being hit much harder.  After a peak of around 10k visits per day, it's now settled down to a steady 1k per day, give or take a hundred visits.  It's still hitting the home page only. We've taken some steps to block ads and analytics, as much as we can; it means we are not showing ads or analytics to some real users too, but that's our collateral damage.  We're also not allowing non-English browsers, because this site is targeted only to a region of the United States.  If it is a virus attack, maybe some of the infected Windows machines were cleaned up, I dunno.  As I get closer to my peak season on this site, I'll have to evaluate what effect this will have on my earnings (the home page being the best earner) and whether or not I'll be able to keep it going.  Fortunately, I don't rely on this site for my income; if I did I would be in trouble.  Just waiting to see if this will end one day, as mysteriously as it began, or if it will be scaled up, or …?  I just have no idea. All it appears to do is come hit the page.

What It Means

This is the hard one.  Maybe nothing.  Not that I'm an alarmist or anything (who'm I kidding, of course I'm an alarmist) if this spreads, or is the pre-cursor to some larger attack, it could seriously screw up the web.  It could affect ads. It could affect every type of analytics – if you aren't tracking for conversions, how are you ever gonna know how much of your traffic is real and how much is fake? It could affect end user trust in analytics.

Or it just might go away.

If you've seen or experienced anything like this, please chime in below.

Zombie Robots Are Eating My Site is a post from: Netmeg

————————

In July, 2011, at the Huron Valley Shelter, we were introduced to ”Bobby.”  Our Malamute had died in his sleep at 14 years, and I had had in mind another Alaskan-type dog, perhaps a middle-sized young adult.  So of course I came home with a 100-pound-plus yellow lab, already eight years old, with a noble head, a soft cream-colored coat, and big sad brown eyes.  For the eyes or whatever reason, he reminded my daughter of someone named “Lenny”, and “Lenny” he became.

Lenny put that bone there

Wherever Lenny spent his previous years, he had been well fed, well trained, already neutered.  He was very large, and some would say past his prime – not everyone’s candidate for adoption.  But he charmed us with his easy response to basic commands, his mindful, no-nip acceptance of treats, and his amazingly expressive “helicopter” tail.  We’d never before had a shorthaired dog, or one with long soft ears that flopped wildly when he galloped after a ball. But once home, Lenny settled in as if he’d been with us for years and expected to stay forever. The bowls, the toys, the big bed he inherited – all these were immediately his, as we were now his own people. Like our departed Worf, he loved food, treats, walks, other animals, and everyone he ever met.  (Our incumbent – and territorial – cat wasn’t even on his radar.)  He lived for attention and company, and would ask for “cuddles” with a huge but gentle paw to the nearest knee.  His house training was impeccable.  He could bark, but very seldom did, and then only outside the house.  From July through December, we had early walks and long days together, and we expected many more.

In January, 2012, over one or two days, Lenny ‘s eyes became red and swollen, and sensitive to light.  Suspecting nothing more than some infection, we went to see the vet.  But when the doctor beckoned me from the waiting room to a private area, my heart sank even before she said “Lenny is very sick.”  It was lymphoma – cancer of the lymph nodes; treatable in many cases, but not really curable.  It had come on quite suddenly (he’d had a thorough going-over in December).  We had a choice of months of chemotherapy or lifelong Prednizone medication, neither of which carried any guarantees, both with results varying widely.  The initial Prednizone dose had cleared up Lenny’s eyes overnight, so we hoped he would respond similarly to the choice of long-term Pred, along with other meds to moderate side effects.  For a couple of weeks, the swollen nodes did shrink visibly, and we hoped for more time.  After all, Lenny was still alert, ate well, and seemed free of any discomfort.  But his strength was failing: our daily walks went down to twenty minutes, then ten, then just to the back yard.  Now he slept for hours at a time, and then slept some more. We were watching him fade, hard as we tried to look away.

In his last few days, lymphoma swelled  Lenny’s hind legs so pitifully, he could not bend the joints, so that walking, and even standing upright, gave him great difficulty.  At the same time, the Pred made him need to relieve himself every couple of hours around the clock.  Two or three times in the winter night he would somehow get himself silently to my bedroom doorway, and I would somehow wake at the sound of his toenails clicking and his tags gently jingling, and fumble for my robe and slippers.  We would make it out to the deck and down three easy steps (gravity helped).   Coming back up meant hoisting a 100-pound dog by the haunches, but we managed.  And never once – never once – did he make a “mistake” inside the house.

Early on February 16, Lenny was almost helpless, and we began really to face the inevitable. Two of us got him into the car; and for the first time, at the vet, it took two people to help him out again.  He did walk to the exam room, and he lay easily for the vet while I sat on the floor beside him, slipping him some favorite treats.  There was no more remission:  the meds had failed him, the ugly swollen nodes were everywhere, and the vet could offer no further hope.  I heard myself say “I guess it’s time to let him go” before I simply broke down.

While the vet and her assistant went to prepare, I had a few minutes alone with Lenny to stroke him and sing him our silly little private song which just repeated his name over and over, before a sedative put him into a very deep sleep.   With the final injection, Lenny was gone, calmly and quietly, with his beautiful great head in my lap.

Handsome, loving, gallant Lenny was only eight and a half years old when he died; we had had a brief six months to give him family and love and fun, and then scarcely another month just keeping him comfortable, when he deserved so much more.  I cried as hard for Lenny as I did for our dogs who had lived out their rightfully long years. The time Lenny didn’t have is only a fraction of the years he’ll still be a “forever” dog for us.

– JRG

Lenny is a post from: Netmeg