Abnormal Spike in Traffic- Ddos or what?

[RishadShaikh59]

We've noticed a 100% increase in our traffic over the last three days. However, the page views have not increased proportionately. The traffic sources seemed to be dispersed naturally. Could this be a Ddos in the making or some other type of attack as it seems unlikely that we suddenly started receiving thousands of extra visitors. Its a leading news website with a consistent heavy traffic daily which just doubled over the last three days. What should we be looking at?

[CPU]

As you have looked at the traffic sources and they seem to be natural I would then look at what the visitors are doing on your site.

Is the bounce rate up considerably? Has the time per visit fallen dramatically?

If not, if the traffic seems to be coming from a natural spread of sources and the behaviour on the site of the visitors is normal then just be glad of the extra traffic.

[RishadShaikh59]

That's the thing...after a drill down, everything seems very natural...the IP sources are varied, the traffic sources have propotionately increased and the mapping also shows an increase in traffic from diverse locations. Analytics does not seem to indicate a particular planned trend...though the spike in traffic still feels a bit odd!

[RishadShaikh59]

That's the thing...after a drill down, everything seems very natural...the IP sources are varied, the traffic sources have propotionately increased and the mapping also shows an increase in traffic from diverse locations. Analytics does not seem to indicate a particular planned trend...though the spike in traffic still feels a bit odd!

[CPU]

Depending on your analytics package you should be able to look at information such as network and location of visitors and drill down into them to see if the traffic is coming from an unusual source. For example on a UK site I look after with a small local focus they have had a number of visits from Tawain via the Taiwanese Google site. This may give you some insights as to whether it seems to be a real bounce or something more sinister.

[baptisteplace]

Have you looked into the server activity log ? You may check the referer, the IP used and more. If this is a well done DDoS your servers should be down. Check the traffic : does the increase is a direct traffic ? Does it comes from search results or referring sites ?

A DDoS has only one goal and will probably use a direct request. I doubt this is the case for your site.