Would you be able to detect the attack and stop it before it caused any damage? Or would you be stuck trying to cleanup after the attack was finished?

Recently at SEER interactive while examining some unusual traffic to a client’s website, we discovered that Google Analytics was picking up an attack against the site as legitimate traffic. With a little digging we found several key indicators which can help you determine if the traffic to your site is actually traffic, or if some of it is an attack against your site. Also included in this post, is a recommendation on how to handle an attack once discovered, and the end of this post is an Alert you can setup in Google Analytics that should email you if someone starts to launch attacks against your site.

The site we were examining recently had a dramatic increase in direct traffic without an outside event to explain the increase such as a newsletter, TV appearance or marketing campaign. Since direct traffic gives us very little information, the best place to start is the Visitor report. Once inside the Visitor report, we can take a look at the map overlay, drilling down to the city level to see which cities are responsible for sending the most traffic to your site.

Carefully examine the top cities in this report, do the top cities seem appropriate to be your top cities? Does the amount of traffic from these seem to be much greater compared to the rest of cities sending you traffic? This is the first sign that you are suffering from an attack, as these top cities can be the launching point for these attacks.

You will often see a sudden sharp increase in traffic, starting on the day the attack was launched.

Hmmm… Does this graph look strange? It should!

Simply seeing an increase in traffic from a city is not in itself enough evidence to say that you’re site is being attacked. If you drill down into the city report itself there may be a couple more indications that you’re site is being attacked. These factors are also useful if the attack has been sustained for a long period of time you and there is no sudden sharp increase of traffic to alert you of the attack.

• Pages / Visit will be closer to 0 than site average.
• Time on Site will be closer to 0 seconds than site average.
• % Of New Visitors will be closer to 100% than site average.
• Bounce Rate for your site will be closer to 100% than site average.

Why do these numbers indicate that your site is suffering from some kind of an attack?

Most Bots do maintain sessions.

Since bots do not maintain sessions, each time the bot queries your site it appears as a new visitor, who immediately leaves, resulting in a bounced visit. This is also why the attack shows up as direct traffic in your reports. If you receive a significant number of these visits your numbers will be skewed to look like the results listed above.

It’s important to note that depending on the amount of traffic your site gets, and the nature of your site, you may not see all of these trends. However if you see a significant difference in these stats compared to other referring cities there is a good chance that your site is being attacked.

What Next?

You have determined that you’re site is suffering from an attack, or you suspect that it might be what are your next steps?

Since Google Analytics is just a reporting system, and it cannot collect the IP addresses of visitors, Google Analytics cannot do anything besides alert you that your site is suffering from an attack.

Since you can’t use Google Analytics for this, the best idea is to contact your hosting company. If you give your hosting company the cities from which you believe the attack is originating from they should be able to determine what IP addresses the attacks are coming from and block them, thus ending the attack.

Google Analytics Alert

If you would like to setup an Alert in Google Intelligence to email you if any of this behavior is detected follow these steps:

• Login to the Google Analytics profile you wish to setup the alert on.
• Select “Intelligence” (beta) from the left navigation.
• Select “Create Custom Alert”.
• Enter an Alert name such as “Hacking Monitor”.
• Select Period -> Day
• Check Receive Email Alert

Now for the fun part, the alert itself! Do not include quotes when entering these values in Google Analytics.

• Select this applies to -> “City”
• Select Condition -> “Matches Regular Expression”
• Enter Value -> “.*”
• Select Alert me when -> “Visits”
• Condition -> “% Increases by More than”

Example Alert:

The final two values of this alert will depend on your preferences and your website. If your website doesn’t receive much traffic you are probably safe putting a high value here (500%+ increase) as any attack will likely result in this increase in percentage. However if you run a larger website, you’ll need to decrease this number, since the attack will be a smaller percentage of traffic from that city. The last value is if you want to compare to the previous day, or to the same day the previous week, this will depend on the traffic patterns of your website.

The end result of this alert will be Whenever any city sends you a dramatic increase in traffic, the primary indicator of an attack on your site, send an email alert.

The last thing to keep in mind is that this alert will only let you know of hacking attacks that run Javascript. If the attacks do not run Javascript then the Google Analytics code snippet will not trigger and the attack will not be recorded as a visit.

Have you noticed this kind of activity on your site before? Do you make use of any other Google Analytics alerts to protect against foul play?

Comments and Questions welcome!

Some keywords unfortunately tank well on pages that you do not wish they pulled rankings for (like a homepage), this is expecially big in e-commerce or large publisher sites.

At SEER we are marrying bounce rate and ranking data to help us find keywords that are ranking well but are bouncing highly. This is why its got to be able more than rankings.

Later in the video, I even mention a GREAT use of a scraper that can tell you when you are NOT price competitive, watch the end of the video to get an idea on why not being price competitive in large scale e-commerce can lead to great rankings but poor conversions.

Who would think that you can get better SEO revenues without even moving the ranking one bit?

A few weeks ago Laura wrote about bounce rates versus exit rates, even if you think you know what bounce rates are, read this just to make sure, because I had it wrong.

E-commerce SEO’s read this post on the long tail, the next part (which I am late on) will be heavily focused on e-commerce SEO.

So let’s start with a quick review. What is a bounced visit? In Google Analytics, a bounced visit is someone who views only one page on your site and leaves. In other words, whatever page he enters on is the only one he sees. Bounce rate is the number of bounced visits as a percentage of all visits. (It is important to note that some people/tools define a bounced visit differently – often in terms of a short amount of time spent on a page.) Additionally, in Google Analytics, when you’re looking at a Content Report, you’ll also see a metric called “% Exit.” What is % Exit? It represents the percent of visits that left your site from a particular page. How is Bounce Rate different than % Exit? To be considered in Bounce Rate, a person must view only one page and then leave but a person can view any number of pages (1 or 10 or 100) to be counted in % Exit.

Ok, here’s a scenario. Suppose you are looking at the Top Content pages for your website (the report that shows you the most viewed pages for your site in Google Analytics) and you see a line that looks like this:

Perhaps that line in your report is a step in your checkout process. Look at the bounce rate for this page – 100%!

This is where the important distinction between Bounce Rate and % Exit comes into play. What does this bounce rate of 100% mean? Literally it means of all the people who LANDED on this page left this site immediately. Because we’re looking at a Top Content Report, it does NOT mean 100% of the people who saw this page left. So how many people viewed this page & left without looking at anything else? Actually only 1 person. (You’d find this data by drilling into Entrance Sources or Keywords for this particular page.) If you want to know how many people come to your site, start the checkout process, get to this page and then decide to leave, you’d want to look at the % Exit (in this case 53.91%). While you might be worried that 54% of people who view this page decide not to complete the checkout process, at least you’re not thinking 100% of people who view this page leave.

If Bounce Rate is not always an appropriate metric to look at when viewing a Top Content Report, when would you be concerned about high bounce rates? Here are some good reports for Bounce Rate:

- Traffic Sources: For example, if you’re running a PPC campaign on Google and see that your Bounce Rate is much higher than your site average, you might be concerned that your landing pages are not resonating with your searchers.

- Keywords: Perhaps you find a keyword that you’ve been working to improve in organic rank but the Bounce Rate is high. Check for the landing pages for that term. Maybe your content is not quite relevant. Maybe you are lacking strong calls to action. Or maybe you should abandon trying to improve rankings for that term.

- Top Landing Pages: It may seem obvious but instead of looking at the Bounce Rate for a Top Content Report, I’d look at a Top Landing Pages report. The important distinction – with Top Landing Pages, by definition, you know a visit started on that page. Thus, if I saw a landing page with 100 entrances and a bounce rate of 100%, I would be concerned.

I hope this helps clarify the difference between Bounce Rate and % Exit. I’m a strong believer that your web analytics data is only as good as it is accurate. But more than that, your data is only as good as you can correctly understand and interpret it. Once you understand the data you’re seeing, it can be very powerful. At SEER, we believe in working to drive more traffic for our clients, but it’s important to know that this traffic is taking the actions you want on the site. Bounce Rate and % Exit are two of the metrics that can be extremely valuable in improving conversion rates.

Today Laura, sent out this post on Google Analytics integration with phone tracking and Liveperson. At SEER we have vetted a ton of companies that do phone tracking, we started this process about 18 months ago with Voicestar and liked many things about them (especially the API).

But I’ll tell you a story on why now more than ever every search marketing company should be doing phone tracking. Lets start with a real example:

One of our clients found that after implementing phone lead tracking that we were under reporting our results by 50%!!! In other words if we reported 100 online leads in a month, they actually had 150 that came from search! We were turning a positive ROI at 100 leads, but by finding this out we changed the entire economics of the campaign, we could change positions, we could enable keywords that we thought were NOT returning a positive ROI, just to name a few. This resulted in increased budgets and more leads because we had a more accurate view of our impact down to phone calls.

Sage Lewis wrote this story comparing 3 phone tracking services again we liked Voicestar, but their pricing is REALLY complicated and high, however their system is robust, so again, we liked it – but I really like seeing more competition in this space, Mongoose has pricing that is MUCH easier to understand.

With the post from Google analytics above it just got me thinking that if your SEO/SEM/PPC agency is experiencing tightening budgets you should have your clients implement call tracking especially for B2B clients and even for complex lead gen / and e-commerce sites.

Our client was a B2C client with a very VERY basic form for leads and they were still under reporting our leads by 50%! Can you imagine the B2B marketers out there selling complex software solutions that may have a longer sales cycle and more questions?

Why should you go through the hassle of vetting phone companies? Simple, by implementing call tracking you are helping your clients get a more accurate view of the traffic you are driving and possibly showing them a more accurate (and hopefully better) ROI. Its the right thing to do!

Be ethical! – Remember you have to take out calls from branded search if you want to be 100% on the up and up and not take credit for people calling in because they searched for the client name. Taking credit for branded search from an SEO campaign is one of the ways you can get ripped off by SEO’s.

If your client says that they don’t have the money to do this, I am thinking that in this economy they can not afford NOT to know the true value on the leads driven by their search campaigns and their true search ROI. Someone asking “how did you hear about us” on the phone is just not cutting it in this economy. Mongoose is offering a GREAT credit which basically makes the first month free, and it integrates with several popular web analytics tools. If you decided Mongoose is not right for you and you go with another solution but want to save money, you may only need to run call tracking for 3 months to see the percentage of calls to online leads ratio and apply that as an estimate of online leads going forward, allowing you to drop the provider after a while.

We are going to be playing with this soon and will update you guys with what we find.

What are you waiting for?!! Go save (or increase your budgets) by implementing call tracking!

Philly.com
Compact Appliance
MSNBC
Hewlett-Packard
Centers for Disease Control & Prevention
AARP
MLB.com
Cornell University
Pontiac
Sports Illustrated

Ok – how many people came up with this: they all use Omniture as an analytics tool? If you did, you get partial credit because that’s only half the story.

Let’s examine part of the source code for sportsillustrated.cnn.com. And don’t forget – this is a page rank 8 site:

If you’ve looked at Omniture code before, you’ve probably seem something like this before. However, have you ever noticed the line about halfway through this code that starts with < noscript >? It contains a link to Omniture with the title “Web Analytics” (keeping in mind that “title” is different than anchor text). The rest of this tag loads a 1×1 tracking pixel (that’s what comes after img src). Now, I’m not a coding expert, but it looks to me like this is a link to Omniture.

That’s right. All the sites above link to Omniture.

Don’t believe me? Let’s examine further. I ran a link analysis on the homepage of the CDC site. There are 17 external links off www.cdc.gov:

Notice the last link points to Omniture, although it does not have any anchor text associated with it.

Ok, so we’ve established that there are external links pointing to Omniture from sites that have Omniture installed. Then I started thinking about how many sites actually use Omniture and how many links that must be. To give you a rough idea, Wikipedia has 48,400,000 links while Omniture has 39,300,000. To be fair, I repeated those searches multiple times and came up with different numbers but every time, Wikipedia and Omniture had tens of millions of links.

To put those numbers into even more context, WebTrends has 47,900 links. Unica and Coremetrics have fewer than 10,000 links. (For fun, look back at the image and check out the number of .edu links that both Omniture and Wikipedia have.)

I did notice, however, that not all sites that use Omniture have this link included. While sportsillustrated.cnn.com has the link, cnn.com appears not to have it. CNN’s code does call for the 1×1 pixel, but the noscript does not contain the link:

I have not been able to figure out the pattern by which Omniture-using sites have the link and which do not. I am not sure if it depends on the version of the code that is installed or if it is individual manipulation of the code, but I do know that it is not included on every install.

After I got this far in my analysis, I started wondering if other analytics tools are using the same sort of tactic. After all, many analytics packages will call a 1×1 pixel in a noscript tag. Here’s what a 1×1 pixel from WebTrends looks like:

The code simply calls the 1×1 pixel, no img alt, no link to WebTrends, no text like “Web Analytics.” Clean. Simple. Quantcast also calls a 1×1 pixel. Additionally, Quantcast does have a link back to the site, but the link points to a page that is not the homepage. Every install of this tag points to a different page.

Now I’m sure the engines discount some of the Omniture links, particularly because many of the sites with Omniture installed have these links on every page (since Omniture tracking code must be installed on every page). For example, a Yahoo search reveals 21,100 pages on CompactAppliance.com that link to Omniture:

To me, it just doesn’t seem right. Particularly because this link is buried under a line that says, “Do not alter anything below this line.” It’s also suspicious because there is a title that says “Web Analytics.” Why not just “Omniture”? As a web analyst for our clients, I often request that clients add tracking code to their pages. However, I only want to install what is absolutely necessary to get the job done. Moreover, if this is an attempt to gather links, where does it stop? It seems like a slippery slope of stuffing things into noscript tags.

In researching this post, I came across some others who have discussed uses of the noscript tag. In late 2006, Eric Enge wrote about uses of noscript and in his post, mentions a WebmasterWorld forum that suggests that noscript links do not pass PageRank. I tried to look for an official answer from Google, but this is as close as I got. From this, I gather that Google wants you to have the same content in javascript as in the noscript tag, which doesn’t seem to be the case with these Omniture links. In the comments to Eric’s post, “Marshall” mentions that a shopping cart company is dropping links in the noscript as well. As Eric responds, “The issue is that the company using the shopping cart does not even know that they are linking to the shopping cart company.” How many Omniture users know the code contains a link to Omniture? Additionally, Stephan Spencer uncovered a similar tactic being used by Bidvertiser in early 2007.

All of this makes me wonder how widespread this practice might actually be. And it would be interesting if Google (or Matt Cutts) could address this issue specifically. Is this an acceptable practice? If not, are these links discounted in any way? Do (or will) companies that engage in this type of practice face any repercussions? For now, I’m going to be paying much closer attention to code that is “required” to be installed on client sites.

I should be sleeping right now, but I read something that I had to briefly write about. I was just in Vegas last week, presenting on how to future-proof your SEO strategy and I mentioned keeping an eye on Google / Yahoo etc using data on your site in helping them determine relevancy for SERPS.

At the time I didn’t have any examples of this happening for Google Analytics and I still don’t.

But The Google Blogoscoped post I linked to above & this one here from Marketingpilgrim discuss how now you can “choose” to share your Google Analytics content with Google so they can use the data for other products. I would think it is a no brainer for them to use this data to improve SERPS someday (i.e. spam sites aren’t sticky, so sites with low time on site could see a negative tick mark in rankings – Oh I can’t wait for the day when real data is one factor used in helping determine who ranks where.)
By choosing to share your data with Google (yes this is an opt-in program, read the FAQs) you will also get data from Google on how you compare in your industry to other sites (who are using Google analytics AND opt in). By the looks of things the data points you’ll be able to compare your site against others include:

• Visits
• Bounce rates
• Time on site
• Pageviews
• Pages per visit
• New visitor percentage

For those of you seeking competitive information back in November of 2006 Laura wrote about using some tools to spy on the competition. I have used the fireclick index in the past when clients ask about trends and benchmarks. It will be interesting to see how this compares, if you look really closely at the firclick data, you kind of say,
“OK so what am I going to actually do with this information?” Will this go the same way? I hope not, I hope the verticals are more finite, the fireclick verticals in my opinion are too broad.

Well anyway, If the data points above are any indication, where I think this data makes great strides over what is out there are in the following 3 areas:

1. You finally get real numbers, Quantcast, Compete, Alexa, etc are all questionable in the accuracy of the data. Quantcast data is much better when publishers use their quantified program.
2. “New visitor percentage” will allow you to tell the velocity by which your competitors are ramping up efforts to attract new visitors, right now Quantcast, Alexa, Compete, etc are not equipped to give you an idea on if your competitors site is just getting more visits from the same people or from a totally new set.
3. “Bounce Rates” will be huge, if you can see that you are on the bottom of your industry group for bounce rates, you could look at your top competitors, check their pages to see if they have Google Analytics page tags installed, and if they do, you could then review their sites to see what they are doing different / better.

The issues I can see already are:

1. Could I set up Google Analytics on an old domain, that is in my industry, but I don’t use anymore to get access to industry benchmark data, but not actually opt in my real site, allowing me to get access to data while not contributing to giving good data to the system.
2. The above issue immediately leads to another issue, garbage in, garbage out. If people try to use alternative domains to get access to the competitive data benchmarks then they are polluting the industry benchmark with poor data, thus decreasing the value for themselves and others. I hate people who do stuff like this, bit there is money to be made on the web and people will find opportunities to exploit a great opportunity like this, where in theory everyone that shares their data gets something out of sharing.

But the Google teams are known to be pretty sharp people, I’m looking forward to seeing this rolled out.

GO GOOGLE ANALYTICS – Even TECHCRUNCH’s Michael Arrington wants your data shared.

UPDATE: Googleblogoscoped has updated their post with screencaps.