About two months ago a site of mine started getting some sort of attack, and after further investigation I found it to be botnet zombies and something else which I can't figure out.
My site is not ecommerce, wasn't popular and has nothing that anyone would want. In google analytics, it went from 800-1000 visits/day to 100k plus/day.
The first round of attacks stopped, and when it did it stopped gradually. So it went from 100k-50k-30k-10k-5k-1k/day and finally back to normal. The strange part is that it is so spread out that it would be impossibly to block the IP's as there are thousands upon thousands. 90% is from the U.S., and its all coming from users with Internet Explorer, versions 6, 7, 8. There are absolutely no similarities in IP blocks that would stand out.
It started again about 3 weeks later and this time stayed extremely steady. I started using Cloudflare Pro in order to route the traffic through their DNS and be able to see the attacks and what they were doing more simply.
I blocked all countries in which attacks were coming from besides the U.S., since its my audience.
I'm totally lost as to why this immense amount of U.S. traffic that looks real continues to come to my site. The average time on site is 8-10 seconds, but I filter out bounce visits and the average time is 2 minutes+ from the mystery traffic. I've contacted my hosting provider many times and they have worked with me a great deal to try and figure this out, and they can't either.
Bottom line is the traffic looks real, but its not. Any help or advice would be greatly appreciated.