Chinese Trojan Spam Virus Attacking Websites

Since installing Google Analytics I have been checking my webstats on a near daily basis. However, because of my lack of blogging over the last few weeks I have also been monitoring the stats less. Today I learnt my lesson that maybe I should maintain a daily watch. Over the last few days (yesterday in particular) there has been a dramatic spike in the number of visits to my site despite no new blog posts being added.

Looking at the data in more detail it appears a lot of traffic is being generated out of China by a site called qq829.com

Looking into this some more there is this thread on a lot of traffic appearing from China and on the Google Analytics forum.

Furthermore both HubPages and Symantic have information on the Trojan that is causing the problem.

At this stage it does not appear that my website has been infected with Malware or compromised in anyway, however, please ensure that your antivirus software is up to date as this particular Trojan could be costing you a lot of traffic and could potentially cause other problems.

Furthermore I have now blocked traffic originating from the qq829 website, other people are blocking all of China but at this stage I am not considering it.

If you are facing similar weird problems with bursts of traffic to your site you can block the qq829 website by adding these lines to your .htaccess file.

SetEnvIfNoCase Referer "^qq829" TOBLOCK=1
SetEnvIfNoCase Referer "^cnzz" TOBLOCK=1

<FilesMatch "(.*)">
Order Allow,Deny
Allow from all
Deny from env=TOBLOCK
</FilesMatch>

deny from 219.232.240.0/20
deny from 203.171.224.0/20

Busiest Month Ever

Over the last month blogging about Tsunamis and Linux has seen my blog stats skyrocket.

The data:
Raw Visitors: 6,114 (note this includes robots, crawlers etc)
Raw Pageviews: 17,374 (note this includes robots, crawlers etc)
Google Analytics Visitors Count: 2,257
Google Analytics Pageview Count: 3,303
RSS Feed Visitors Count: 2,771
Combined RSS + Google Visitors Count:  5,028

This is up a total of 800 visitors from the month before.

Visitor Locations From Google Analytics:
2,257 visits came from 83 countries/territories
2,257 visits came from 652 cities

Most Popular Posts:
Ubuntu 10.04 Lucid Lynx First Impressions
Word 2007 crashing on Windows 7 or won’t open documents
Getting ATI Radeon HD Drivers to work in Ubuntu 10.04 Beta 1

Six months of Google Analytics tracking

In the past I have completely hated tracking cookies and the way in which ad websites track your browsing habits across multiple pages, sites and visits. However, as the web has developed tracking cookies have become more and more the accepted norm to the point now where I accept most cookies and have even installed them onto my website to track visitor movements in the form of Google Analytics.

Google Analytics is a very powerful tool for being able to analyse your visitor numbers and browsing habits. Over the last six months I have been using the data collected to shape my blog posts in such away to attract more visitors but also retain the regular ones I have with things of interest and stop posting about those things that the data suggests people are not interested in. The main change in topic area as a result of this has seen me blog less about politics – leaving that to the heavy weights of Kiwiblog, No Minister, Frogblog and others. In place of these blog subjects I have been focussing more on computers, science, religion and general news related topics. This has seen the number of posts made decrease slightly but an increase in the number of comments made and a steady level of site visitors and a large rise in the number of visitors to the site’s RSS feed.

Below are the main highlights of the Google Analytics data from September to February, please note the visitor numbers are only those hitting the main site (as Google Analytics does not track RSS hits), Google Analytics also filters out bots, spiders and other automatic crawlers and aggregators so this is some of the best data I have on actual true human visitors to the site.

Visitors plotted by week

Breaking down the visitors by city is a really nice way to see how the blog is having a worldwide reach. Sure the vast majority of my visits come from New Zealand, but the data also shows many visits (in order from most visits) from London, Sydney, Melbourne, Brisbane, Singapore, Dublin, Perth, New York, Manchester, Los Angeles and more than 1,700 other cities around the world.

The breakdown of visitors by web browser makes for good reading especially as Firefox is beating Internet Explorer.

When you then add in the operating system into the mix Internet Explorer and Windows comes back to the top though.

The search keywords is one of my main sources for determining what topics I should blog on, as you see no politics related searches here:

So that’s it, I use Google Analytics to “spy” on visitors and but will happily share most of the data with you. The only thing I have excluded from this round up is the list of the most popular blog posts – but they are listed in the sidebar anyway (updated monthly). It will be interesting to see in another six months what has changed. In particular if changes in my personal life (moving countries) will affect my blogging and in turn affect my visitor numbers and trending.