NicolasPC

Hi Lindy, Yesterday was a good day again, with a very large majority of French traffic, and at the same time Google AdSense revenue went back up. This seems to confirm that the two issues were linked. Today it still looks normal, so if it stays like this, the problem seems to be resolved on my side. Could you just let me know if your team changed anything? I would like to understand what solved the problem. Thanks again for your help. Nicolas

Hi Lindy, Just a quick update, as there has been a significant change since my message yesterday which may be useful for your investigation. I have not made any changes on my side to the site or to the GA4 configuration. Since approximately yesterday afternoon, the abnormal international traffic reported by GA4 has dropped very significantly. More importantly, this change has continued overnight and throughout today. At around 13:20 today, GA4 reports: France: 5,144 views (68.84%) United States: 536 views (7.17%) Brazil: 257 views (3.44%) Colombia: 236 views (3.16%) Ecuador: 130 views (1.74%) By comparison, at the time of my previous message yesterday, GA4 was reporting: France: 4,467 views United States: 3,529 views Brazil: 1,190 views Colombia: 992 views The GA4 real-time map is also now overwhelmingly concentrated on France and nearby European countries, whereas previously there was substantial activity from the United States and South America. The abnormal international traffic has dropped dramatically, while normal French traffic has continued to increase. Interestingly, during the same period, I have also seen a significant improvement in Google AdSense performance. At approximately the same time yesterday, the AdSense page RPM was around €1.09. Today, at around 13:20, it is €3.66, despite having fewer page views. Ad impressions have also increased significantly: approximately 10,900 today compared with 6,530 at a similar time yesterday. I understand that this does not establish a causal relationship between the GA4 traffic and AdSense performance, but the timing of these two changes seems noteworthy. As I have not changed anything on my side, I thought this sudden and sustained change might be useful information for your investigation. Do you know whether any change or mitigation was applied on the Invision/Cloudflare side during this period. If you or the Invision team did make any changes or apply any mitigation measures, I would of course like to sincerely thank you and the team. The improvement we have been seeing since yesterday afternoon is very significant and greatly appreciated. I have attached screenshots of the current GA4 and AdSense reports for reference. Thank you again for taking the time to investigate this issue and for your help. Best regards, Nicolas

Thank you, Lindy, for checking the raw connection logs. This is very helpful. I have now performed the hostname check you suggested in GA4. The result is interesting: the traffic GA4 attributes to the United States, Brazil and Colombia is reported with the legitimate hostname www.planete-citroen.com. At the time of this screenshot, GA4 reports: France: 4,467 views United States: 3,529 views Brazil: 1,190 views Colombia: 992 views All of these views are associated with www.planete-citroen.com. There are no blank, (not set), or unrelated hostnames shown. The GA4 interface is in French: “Nom d'hôte” means “Hostname” and “Vues” means “Views”. Therefore, it appears that a valid-hostname filter would not remove this abnormal traffic in my case. I understand that this does not necessarily mean these requests actually reached the Invision infrastructure, since spoofed GA4 events could presumably also include the legitimate hostname. Does this result still look consistent with GA4 measurement/phantom traffic from your perspective? If so, is there another GA4 dimension or parameter you would recommend checking to confirm it? Thank you again for investigating this.

Hello, I am sorry to post another update, but the situation this morning is becoming extremely concerning and I really need the Cloud team to investigate this traffic at server/WAF level. At only 7:30 AM France time on September 22, GA4 has already recorded 7,233 page views: United States: 2,294 (31.72%) Brazil: 844 (11.67%) Colombia: 680 (9.40%) Ecuador: 381 (5.27%) France: only 922 (12.75%) The United States, Brazil, Colombia and Ecuador therefore already represent approximately 58% of all page views this morning, while France represents less than 13%. As shown in the attached GA4 report, this traffic is again distributed across a very large number of unrelated and often old topics, including deep pages and Invision actions such as do=showReactionsComment, rather than being concentrated on any particular popular content. From my side as an Invision Cloud customer, I unfortunately have no server/WAF access that would allow me to identify or rate-limit these visitors without restricting legitimate guests and search-engine traffic. The country-level user behaviour makes the anomaly even clearer. At the same time this morning, GA4 recorded 3,734 active users. The United States alone accounted for 1,263 active users (33.82%), compared with only 301 from France (8.06%). More importantly, almost all users from the countries generating this unusual traffic are new users, with 0 seconds of average engagement time: United States: 1,263 active / 1,265 new — 0 sec Brazil: 466 active / 466 new — 0 sec Colombia: 389 active / 389 new — 0 sec Ecuador: 214 active / 214 new — 0 sec By comparison, France shows a completely different and expected behaviour: 301 active users, 197 new users and 1 min 30 sec average engagement time. GA4 cannot by itself prove that these visits are automated, but the contrast is extremely unusual and strongly consistent with the abnormal crawling pattern described above. This is why I really need the Cloud team to examine the corresponding server/WAF logs. I would also like to clarify why I have been mentioning the AdSense impact. I am not claiming that I can see Google's internal invalid-traffic classification. I cannot. However, Google's own AdSense documentation explicitly states that invalid traffic can include automated traffic sources and robots, that Google analyses abnormal usage patterns and filters invalid traffic, and that invalid traffic can affect impressions and earnings. Official Google documentation: Google AdSense — Invalid traffic Google AdSense — How Google prevents invalid traffic Google AdSense — Troubleshoot issues with impressions Google AdSense — Invalid activity deductions from earnings This documented mechanism is consistent with what we are observing: a very large increase in abnormal traffic occurring at the same time as a severe deterioration in AdSense monetization. Again, I am not asking Invision to diagnose AdSense; I am asking the Cloud team to investigate the abnormal traffic reaching the community. Could the Cloud/Infrastructure team please correlate these periods with the server/WAF logs and check the corresponding IPs, ASNs, user agents, request frequency and URL patterns, and advise whether WAF filtering, rate limiting or another mitigation can be applied? Ticket #205963 has been escalated since September 9, and at this stage I unfortunately cannot take any effective action myself without blocking legitimate visitors. Thank you.

Hello, I am sorry to post another update, but the situation is continuing again this morning and I would really appreciate an update from the Cloud/infrastructure team regarding ticket #205963, which has been escalated since September 9. The attached GA4 reports are particularly revealing. The day has only just started, yet abnormal international traffic is already dominating our audience. At the time of the report, GA4 had recorded 3,753 active users, including: United States: 1,403 active users (37.38%), including 1,400 new users, with an average engagement time of 0 seconds Brazil: 380 active users, all 380 new, with 0 seconds average engagement Colombia: 315 active users, all 315 new, with 0 seconds average engagement Ecuador: 232 active users, all 232 new, with 0 seconds average engagement France: only 319 active users, but with an average engagement time of 1 minute 24 seconds This contrast is extremely unusual for a French-language community. The United States alone currently represents more than four times as many active users as France, while virtually all of those US users are new and their average engagement time is 0 seconds. The page-level GA4 report taken at approximately the same time had already recorded more than 2,500 page views from the United States this morning. These views are distributed across a very large number of ordinary public forum topics, including old topics and deep pagination pages. Some requests are also reaching URLs containing parameters such as do=showReactionsComment. I understand that GA4 alone cannot formally identify individual requests as bots. However, the combination of the geographical distribution, the extremely high proportion of new users, 0-second average engagement and systematic traversal of a very large number of forum URLs appears strongly consistent with automated crawling. The second attached screenshot shows the direct consequences in AdSense. Yesterday, AdSense recorded 27,800 page views — 96% more than the previous Sunday. Despite this enormous increase in page views, advertising performance collapsed: Page RPM: €0.68 — down 79% Ad impressions: 20,900 — down 41% Clicks: 451 — down 21% CPC: €0.04 — down 50% Page CTR: 1.62% — down 60% In other words, AdSense recorded almost twice as many page views, while the value of those page views collapsed. The abnormal traffic is therefore not generating additional revenue; on the contrary, it is coinciding with a severe deterioration in all of our main monetization indicators. This is particularly concerning because these automated-looking visits are now reaching ordinary public /topic/ pages where advertising can be displayed to guests. We cannot simply block guest access to those pages without also blocking legitimate visitors and potentially damaging the normal operation and search visibility of the community. This is now having a direct and severe financial impact on our community. If several consecutive days are affected in this way, it puts a significant part of the funding of the community at risk. Could the Cloud/infrastructure team please investigate this traffic pattern at server/WAF level, where IP addresses, request frequency, user agents, ASNs and other request characteristics can be analysed, and let us know whether any filtering, rate limiting or other mitigation can be applied before this traffic reaches the community? I sincerely hope this issue can now be investigated by the appropriate team. As ticket #205963 has been escalated since September 9, I would be very grateful for any technical update regarding the investigation. Thank you very much for your help. Kind regards, Nicolas

Hi, Thank you very much for your reply. I already have an existing support ticket regarding this issue: #205963. It was escalated by Marc to the advanced/Cloud infrastructure team on September 9, but unfortunately I have not yet received any technical update from that team. The abnormal traffic is still ongoing today and has significantly worsened again, as shown in the screenshots above. It is now systematically crawling thousands of normal public /topic/ pages and is having a severe impact on our AdSense monetization. Since the ticket has already been with the advanced team since September 9, I would greatly appreciate it if you could check that ticket #205963 has reached the appropriate Cloud/infrastructure team and, if possible, ask them to review the new information I have provided here. I would prefer to keep everything within the existing ticket rather than create a duplicate. Thank you very much for your help. Kind regards, Nicolas

Hello Marc, I am sorry to post another update so soon, but the situation has deteriorated significantly this morning and is now having a severe impact on our AdSense monetization. The latest GA4 report shows that the abnormal traffic is no longer targeting only specific sections of the community. It is now crawling a very large number of regular forum topics (/topic/ URLs), including old topics and deep pagination pages. So far today, GA4 has recorded 21,122 page views, including 6,370 from the United States (30.16%), compared with 4,735 from France (22.42%). This means that today our French-language community is actually receiving more page views from the United States than from France. The report clearly shows that these US views are distributed across a very large number of ordinary forum topics rather than being concentrated on one particular page. This is consistent with automated crawling of the community. As shown in my previous report, this abnormal international traffic also has extremely poor engagement, with 0-second average engagement time for the United States and several other countries, whereas legitimate French traffic shows normal engagement. The most serious consequence is now visible in AdSense. At approximately 12:12 PM today, AdSense had already recorded 13,300 page views, but only 7,400 ad impressions, with the page RPM collapsing to just €0.69 and page CTR to 0.84%. Estimated revenue was only €9.20, despite this exceptionally high number of page views. In recent days, when traffic quality was much more normal, our page RPM was around €3 or more. The sudden combination of huge volumes of abnormal page views and the collapse in RPM strongly suggests that this traffic is severely degrading the monetization of our advertising inventory. Unfortunately, because these requests are now reaching normal public forum topics containing advertising, I cannot simply block these pages for guests without also blocking legitimate visitors coming from Google and seriously affecting the normal operation and visibility of the community. This is therefore becoming extremely concerning for us. Restricting individual sections such as Downloads, profiles or search can reduce the exposed surface, but it cannot solve the problem now that the abnormal traffic is systematically crawling ordinary public topics. I am attaching the latest GA4 report because I believe it demonstrates particularly clearly why this issue now requires infrastructure-level mitigation rather than additional community permission restrictions. Could the Cloud/advanced team please urgently investigate whether this traffic can be filtered, challenged or rate-limited before it reaches the community pages and the advertising code? Thank you again for your help and for forwarding this additional information to the Cloud team. Kind regards, Nicolas

Hello Marc, I just wanted to provide an additional update regarding the abnormal traffic affecting our community. The issue is still clearly ongoing today, Sunday September 20. At the time of the attached screenshot, GA4 was reporting 686 active users over the last 30 minutes, with a very unusual geographical distribution for our French-language community. Earlier this morning, AdSense had already recorded approximately 7,900 page views by 8:00 AM, which is far above the traffic level we would normally expect at that time of day. GA4 also reported 5,731 active users so far today, with 2,193 from the United States compared with only 392 from France. Brazil, Colombia, Ecuador and several other countries continue to generate unusually high volumes of traffic. In the real-time screenshot below, only 61 users are attributed to Google, while GA4 reports 686 active users, together with 678 session starts and 604 first visits during thedisplayed period. This appears consistent with the same abnormal traffic pattern already reported in the ticket. I am attaching this screenshot as additional information that may be useful to the advanced/Cloud team in their investigation. The attached GA4 report is displayed in French, but the figures show the situation very clearly: by approximately 9:00 AM today, 6,382 active users had already been recorded, including 2,440 from the United States compared with only 443 from France. Average engagement time is 0 seconds for the United States, Brazil and Colombia, compared with 1 minute 45 seconds for France. Thank you again for your help and for forwarding this information to the appropriate team. Kind regards, Nicolas

Hi Marc, I’m following up as it has now been 7 days since the ticket was escalated to the advanced/Cloud infrastructure team, and I still haven’t received any update.The abnormal traffic is still clearly visible in GA4, with the same unusual geographical patterns and very high numbers of guest requests. Our AdSense monetization has returned to normal, but this is because we have blocked guests from accessing pages where ads are displayed. This prevents the abnormal traffic from generating ad impressions, but unfortunately it also affects legitimate guest visitors. This is therefore only a workaround, not a satisfactory long-term solution.Could you please confirm whether the Cloud/infrastructure team has applied any filtering, WAF rules, rate limiting or other mitigation to our community since the ticket was escalated? If nothing has been applied yet, could you please let me know whether the infrastructure team has identified this traffic pattern and whether server-side mitigation is possible?The abnormal traffic is still reaching the community, so I would really appreciate a technical update on the investigation. Thank you.

Thank you Marc, I appreciate you escalating the existing ticket. I completely understand that this is a wider Internet issue and not something specific to Invision. My main concern is simply whether the Cloud/infrastructure team can identify this particular traffic pattern and mitigate it before it reaches the community, as its impact on our AdSense monetization is immediate and severe. I will now wait for the advanced team to investigate the ticket and I will avoid making further changes on my side in the meantime. Thank you again for your help.

I actually already opened a support ticket about this infrastructure/traffic issue last week, including details about the abnormal traffic and a request to investigate possible bot activity and WAF protection. Unfortunately, I still have not received a response to that ticket, and the situation has now become urgent. The abnormal traffic returned last night and is once again severely affecting our AdSensemonetization. Today GA4 is showing thousands of abnormal visitors from the United States, Brazil, Colombia, Ecuador and other countries, mostly through Direct traffic, with 0-second engagement for several of them. Could you please help escalate my existing ticket to the Cloud/infrastructure team, rather than having me open another one?The financial impact on our community is now significant, so I would really appreciate if someone could investigate this as soon as possible. Thank you.

Thank you Marc. I understand how RPM is calculated, but unfortunately this is not the issue I am trying to report. The problem is the massive amount of abnormal traffic currently reaching the community. GA4 is showing approximately 16,000 Direct sessions today, with thousands of users coming from countries that normally represent only a very small part of our French community. For example, today GA4 reports approximately 4,850 users from the United States, 1,670 from Brazil, 1,590 from Colombia and 890 from Ecuador. Most importantly, the average engagement time for several of these countries is 0 seconds, while France is at approximately 1 minute 17 seconds. GA4 itself is flagging this traffic increase as an anomaly. This happened previously at the beginning of September, then the traffic returned closer to normal and AdSense monetization recovered at the same time. Since last night, the abnormal traffic has returned, and AdSense monetization has immediately collapsed again. So my concern is not the RPM calculation itself, but whether Invision Cloud can identify and mitigate this automated/abnormal traffic at infrastructure/WAF level before it reaches the community and the advertising system. I will open a ticket as you suggest and provide the GA4 screenshots. This is now quite urgent for us because advertising revenue finances a significant part of the community's operating costs. Thank you for your help.

Abnormal bot traffic is back and severely impacting AdSense monetization The situation had returned to a relatively normal level over the last few days, and AdSense monetization was starting to recover. Yesterday, September 8, Unfortunately, since yesterday evening, the abnormal traffic appears to have started again very aggressively. Google Analytics recorded approximately 71,000 page views yesterday, compared with around 40,000 page views on a normal day. This represents an abnormal increase of more than 30,000 page views in a single day. Today the consequences on AdSense are immediate and severe. At 12:47 PM, despite already recording approximately 19,800 page views, with the page RPM collapsing to €0.53. Yesterday the RPM was around €1.51. Google Analytics real-time data again shows a very unusual geographical distribution of traffic, with large volumes coming from countries that normally represent very little legitimate traffic for our French Citroën community, particularly: United States, Colombia, Ecuador, Venezuela, Vietnam and several other non-European countries visible in the attached Analytics screenshot. This is consistent with the abnormal traffic pattern I previously reported: very large volumes of apparently automated traffic generating page views without corresponding normal user behaviour. At this point, this is no longer just an analytics issue. It is directly and severely affecting our advertising monetization and therefore the financial sustainability of the website. Planète-Citroën relies heavily on advertising revenue to cover its operating costs, and repeated waves of this traffic are causing AdSense monetization to collapse. I therefore urgently ask Invision to intervene at the Cloud/WAF level. Could you please: immediately investigate the current traffic and identify the IP ranges, ASNs, User-Agents or other common characteristics responsible for these requests; apply appropriate WAF / Managed Challenge protection against this automated traffic; and, if necessary as an immediate protective measure, block or challenge traffic from the countries currently generating these abnormal volumes, particularly the countries mentioned above. I understand that country-wide blocking is a strong measure, but given the repeated attacks and the direct financial impact on the site, I would prefer temporarily losing the very small amount of legitimate traffic from these countries rather than continuing to expose the site and our AdSense account to massive automated traffic. This is now urgent. The abnormal traffic has returned, AdSense monetization is collapsing again, and the financial sustainability of the site is being affected. Could you please investigate this as soon as possible and let me know what immediate protection can be implemented on the Invision Cloud infrastructure? Thank you in advance for your prompt assistance. Best regards, Nicolas Administrator – Planète-Citroën