From Russia with love: Spikes in web traffic originating overseas



As the nation discussed Russia's potential influence on the results of the presidential election, New Times saw a significant spike in web traffic from Russia to its website.

According to metrics from New Times' site, traffic from Russia dramatically increased in November and December, totaling more than 2,600 web sessions originating primarily from Moscow and St. Petersburg. That's compared to just six sessions from Russia, total, for the same time period the previous year.

That number accounted for more than 7 percent of New Times' post-election web traffic, and rocketed the country from 43rd in total sessions to second, behind the United States.

Russia has come to dominate the nation's dialogue in the aftermath of Nov. 8. During the election, supporters and staff for Democratic Party candidate Hillary Clinton publicly blamed Russian hackers for the leaking and distribution of damaging emails to Wikileaks. In early December, The New York Times reported that American intelligence agencies believed that Russian hackers covertly worked to influence the presidential election.

New Times publisher Alex Zuniga said he was motivated by The New York Times' reporting on the issue to check on Russian traffic to site.

"I started thinking, 'What if they could be targeting anything that's media related?'" Zuniga said.

New Times wasn't the only publication to see an increase of Russian web traffic after the election. The Ashland Daily Press, a small daily newspaper in Wisconsin, saw a similar spike in Russian traffic beginning in December, as the state was in the midst of a recount at the behest of Green Party candidate Jill Stein. 

Rick Olivo, a senior reporter for the paper, said the newspaper's website had 1,500 hits from Russia in December, and 902 in November. In October there were zero.

"For what reason they'd go to a small-town newspaper, I don't know," Olivo, told New Times. "We've got more deer and bears than people."

Olivo reported on a similar spike in Russian traffic to the city of Ashland and Bayfield County, Wis., websites in the wake of the election. The article elicited a strong reaction from the community, Olivo said.

"I got a number of calls from people asking me how to tell if some was hacking into their system," he said.

While Olivo believed the traffic to city and county websites was likely related to the election, he said the traffic to his newspaper's site was likely due to a more common motivation. The hackers may have been attempting to test the system's security, looking to get at readers' personal information, like the credit card numbers they use to subscribe to the paper.

"I think it's common thievery," Olivo said.

The growth in Russian traffic to the New Times' website also appears to have a less dramatic motive. The traffic tracked back to a single page called "Vitaly Rules Google." The site was created by a notorious Russian web traffic spammer named Vitaly Popov, who exploits Google's web analytics tools to drive traffic to his own website. 

In an interview with technology website, Popov said he began his most recent spamming campaign in the months leading up to the election.

"I could begin in a month before the elections and on a wave of the anti-Russian hysteria to receive a lot of traffic," he said.

Popov admitted the move wasn't necessarily apolitical, and voiced his support for United States President-elect Donald Trump in the same interview.

"I like Trump," he said in the interview. "I even sacrificed traffic to help him."

With the use of a filter, Zuniga said he was able to block Popov's site from interfering with the New Times' web traffic. While the spam is relatively benign, if left unchecked it could skew analytic data and web metrics, which companies with an online presence rely on to sell advertising.

"They can get thrown off by this type of 'ghost traffic,'" Zuniga said. 

Add a comment