Got a weird issue that I'm coming up empty on. The past few days (since before Thanksgiving) I'm getting a large traffic spike accessing a specific page, which is a subsection index that doesn't usually get much traffic at all. Google Analytics is showing these views as direct traffic with no referrer, yet they are coming from all over the US and across many different cities, ISPs and IPs. The only commonality is that most of these hits are US visitors and reporting as IE9 and some IE8.
My server actually got overwhelmed once and I had to shut down Apache temporarily. Once I further optimized the page I was getting 300 concurrent visitors to that page in question (this is not normal). The visits appear to be full page loads, as the Google Analytics and ad code is being parsed and serving and cookies are even being accepted - not your average bot/spider.
A couple days ago, I implemented custom logging (to little effect) and am giving users with IE8/9 and no referrer a 403, but am still seeing a slightly elevated load on this page with this solution that I'm not entirely happy with (since it can impact legitimate users). I'm also setting a cookie and logging repeat visitors to this page with no referrer. The IPs are many and varied, however, and I would not be able to block them all.
In my reading on this topic, it seems IE is the easiest to do a JavaScript-based redirect without passing a referrer, so that makes sense as to why this is only happening with IE and leads me to believe someone, somewhere is redirecting lots of traffic to this page (but why?). But I'm wondering if it could also be a result of some malicious program or the like instead.
So my question is multifacetted:
Has anyone experienced this before and have any idea how/why this is happening?
How can I figure out where this traffic is coming from? I would like to figure out the cause and source. -Any tips for custom logging that can get me valuable info (I'm logging HTTP_REQUEST_METHOD, SCRIPT_NAME, QUERY_STRING, HTTP_REFERER, HTTP_USER_AGENT, as well as dumping out the cookies)? -Searching on the subsection URL in Google just gives me a ton of results under that section and links to pages under that section. I've had no luck finding links directly to that page.
How can I profile or stop a DDOS attack like this on a Windows server with Apache? I'm a little lost on this front in the first place.
Thanks in advance. I'm really stumped on this one.
