If things feel a little slow around here lately, this is why. Here’s a breakdown of the traffic to this site in recent days:
| Category | Requests | Share | Clients |
|---|---|---|---|
| Likely human | 47,240 | 1.3% | 1,465 |
| Search engine / scraper | 499,132 | 13.6% | 30,832 |
| Malicious probes | 518,660 | 14.2% | 4,533 |
| 404s | 64,860 | 1.8% | 14,529 |
| Botnet attacks | 2,534,400 | 69.2% | 1,368,272 |
The botnet is a single attack[1], coming from 450,000 IP ranges in more than 17,000 networks, mostly home and mobile ranges in Africa, Asia, and Latin America, with most IPs making only 1-3 requests. The requests are all similar, mangled nested versions of real paths on this site, so it looks like a crawler or scraper gone wrong rather than a targeted attack.
Just another day on the internet.
I discovered this using AI, of course. I was only trying to categorize traffic by source; the AI is the one that noticed the pattern and identified the traffic as a botnet. This stuff is getting pretty impressive.
- It uses a fixed list of 14 browser user agents, all Chrome 99–136 on Mac or Windows, and each one accounts for almost exactly the same number of requests.
- The requests have similar url patterns.
- It runs in bursts with clear start and stop points, peaking around 58 requests a second. Each campaign starts and stops abruptly.