The 11,000 visits that were not mine

On 26 July 2026, Google Analytics recorded 11,012 active users on taamneh.com. It had expected 93. For a mostly dormant personal technical blog, that was not sudden success. It was a security artifact waiting to be understood.

This article is a follow-up to my account of replacing WordPress after a compromise I could not see. The first article explains why I abandoned the old runtime. This one follows the evidence the attackers left behind in Analytics. The site had looked normal when I opened it, while selected visitors could receive gambling content or a redirect.

The Analytics spike gave me a way to investigate the business behind the compromise. It did not identify the operator or reveal exactly what every visitor saw. It did show that my site had become part of a traffic system that had nothing to do with my writing.

An audience that disappeared on inspection

The first dashboard view looked almost flattering: 11,012 active users against an expected 93, an increase of 11,740.9%.

GA4 marked 26 July as an anomaly. The same report showed referral traffic dominating acquisition while organic search remained negligible.

The acquisition data made the number much less impressive. For the period from 26 to 28 July, GA4 recorded 10,873 sessions:

Channel	Sessions	Engaged sessions	Engagement rate	Average engagement time
Referral	10,282	134	1.3%	0.15 seconds
Direct	587	13	2.2%	0.33 seconds
Organic Search	4	0	0%	0 seconds

Referral traffic represented 94.6% of all sessions. Organic search produced four sessions. The supposed audience spent, on average, a fraction of a second engaged with the site.

Google defines an engaged session as one that lasts longer than ten seconds, records a key event, or contains at least two page views. Only 134 of the 10,282 referral sessions met one of those conditions. This was not a group of readers discovering an article and leaving quickly. The interaction was barely long enough for the page and its Analytics tag to load.

The referral column was hiding the useful detail

“Referral” is only a channel classification. It means that Analytics believes another site immediately preceded the visit. Google explains that Analytics recognizes the site a visitor came from and reports its domain as the referral source. Changing the report dimension to First user source / medium exposed the hostnames behind it.

The export for 26 and 27 July contained 10,897 users. Of those, 10,316 were attributed to 518 distinct referral hostnames. Two base domains accounted for almost all of them:

Base domain	Users	Distinct subdomains	Share of referral users
squitoiages[.]com	5,129	213	49.7%
tentedienat[.]com	4,981	225	48.3%
All other referral sources	206	80	2.0%

Together, the two domains supplied 10,110 users, or 98% of the referral total.

They did not look like normal websites linking to a blog. They appeared as hundreds of generated hostnames:

29752235-1682-36227.tentedienat[.]com
29752236-1682-36227.tentedienat[.]com
29752235-33181-36227.squitoiages[.]com
29752236-33181-36227.squitoiages[.]com

The first numeric component advanced across rows while the remaining components repeated in combinations. I cannot decode those identifiers from Analytics alone, but their regularity and scale are consistent with programmatically generated routing infrastructure, not hundreds of independent publishers.

The long tail of referral sources included adult, streaming and gaming domains. Independent security telemetry offered additional context. A public Hybrid Analysis report identified squitoiages[.]com in malicious network traffic. A scanned tentedienat[.]com subdomain was classified as malicious and sinkholed by a DNS security service in a urlquery report.

Those reports do not prove that every hostname or request had the same purpose. They do make it difficult to explain the pattern as ordinary referral traffic.

The homepage was the entry point

The landing page for the spike was /, and the Analytics hostname was taamneh.com. The data was not reporting thousands of visits to hidden paths on another domain. It was reporting sessions that arrived at the homepage of my compromised site.

That finding fits the cloaking we had already observed. The most plausible path was:

generated referral domain
  → taamneh.com/
  → compromised routing or cloaking logic
  → selected content or an external destination

Google documents exactly this class of hacked behavior. A compromised site may return ordinary content to its owner while redirecting other visitors according to their referrer, user agent or device. Its hacked-site guidance also identifies modified .htaccess rules as one mechanism for conditional redirects. In this incident, .htaccess was compromised and direct visits could still show the legitimate blog.

The data therefore connects two observations that initially looked separate. The server showed a cloaked compromise. Analytics showed a high-volume referral network arriving at the same hostname and the same entry page during that compromise.

A traffic distribution system explains the shape

Security researchers use the term Traffic Distribution System, or TDS, for infrastructure that receives traffic, evaluates it and routes different visitors to different destinations. The decision can use geography, device type, referrer, browser characteristics or campaign rules.

TDS technology is not inherently malicious. Advertising and tracking platforms also route traffic. The abusive version provides something especially valuable to an attacker: separation between the compromised entry point and the final offer, combined with enough filtering to hide unwanted behavior from owners, crawlers and security scanners.

Palo Alto Networks Unit 42 describes malicious TDS infrastructure used by phishing operations and online gambling platforms. Spamhaus has documented compromised WordPress sites becoming parts of redirect chains in which one visitor receives a casino destination while another receives a malicious browser extension.

That model explains why the website could appear healthy from my browser. A redirect system that showed its payload to every request would be discovered quickly. Selectivity is part of its operational design.

It also explains the disposable subdomains. Hundreds of generated hostnames allow an operator to separate campaigns, rotate infrastructure, measure batches of traffic and replace individual routes when they are blocked. The precise meaning of the numeric labels in my export remains unknown, but the system did not depend on one stable, recognizable referral URL.

Where the money can come from

The Analytics property reported no revenue, but that tells us nothing about the attacker's income. My site was not the place where a gambling deposit, advertising impression or affiliate conversion would be recorded. It was an upstream component in the route.

There are several established ways to monetize this traffic:

1. Cost per acquisition. An affiliate receives a fixed payment when a referred visitor becomes a qualifying player or depositor.
2. Revenue share. The affiliate receives a percentage of the operator's net gambling revenue from referred players.
3. Hybrid payment. The arrangement combines a smaller acquisition payment with an ongoing share of revenue.
4. Traffic brokerage. One operator gathers or steals visits and sells them to another party that chooses the final destination.
5. Advertising and pop-under revenue. Redirect chains create chargeable impressions, visits or clicks even when the user never intended to follow them.

These are not speculative business models. Gambling.com Group, a public affiliate business, describes CPA, revenue share and hybrid arrangements in its 2024 annual filing. The legitimate affiliate industry uses those models with consent and contractual relationships. A criminal operator can pursue similar economics while replacing earned attention with compromised infrastructure.

I cannot determine which payment model applied to this incident. There is no affiliate identifier, downstream conversion report or financial record in the evidence I retained. What the data shows is the raw material being moved: traffic.

Were these 11,000 real people?

“Active users” is an Analytics metric, not a count of verified human beings.

The pattern is compatible with several possibilities:

• automated browsers opening the page and executing its JavaScript;
• real visitors being redirected so quickly that almost no engagement was recorded;
• synthetic Analytics events designed to imitate referral traffic;
• a mixture of all three.

Many referral rows recorded exactly three events for each new user and no returning users. Google Analytics automatically collects events such as first_visit, session_start and page_view. The export did not include event names, so I cannot say those were the exact three events in every case. The count is nevertheless consistent with a page initiating measurement and doing little else.

The taamneh.com hostname and / landing page make simple misuse of the Analytics tag on an unrelated site less likely. They are still not cryptographic proof of a browser visiting my server. GA4 also supports server-to-server events through its Measurement Protocol, and telemetry fields can be supplied programmatically.

This is why Analytics should be treated as evidence, not as a complete forensic record. Web server access logs, redirect responses, request headers and preserved malicious code would have allowed a stronger reconstruction. Much of that evidence disappeared when the urgent cleanup began.

What is proven and what remains an inference

The cleanest way to tell this story is to separate three levels of confidence.

Observed directly:

• the WordPress environment and .htaccess were compromised;
• direct visits could show the legitimate blog while other requests behaved differently;
• GA4 recorded an anomaly of 11,012 active users on 26 July;
• 94.6% of sessions in the three-day acquisition export were referral traffic;
• two domains and 438 of their subdomains supplied 98% of referral users;
• the traffic landed on / and reported taamneh.com as its hostname;
• engagement was close to zero.

Strongly supported inference:

• the site was participating in an automated traffic distribution or redirect system;
• cloaking helped the system operate without being obvious to the owner;
• the referral hostnames represented coordinated infrastructure rather than genuine editorial links.

Still unknown:

• the original entry point into WordPress or the hosting account;
• the identity of the operator;
• how many Analytics users represented real people;
• the destination selected for every visit;
• the exact commercial arrangement and profit.

That separation matters. Security writing becomes less useful when a plausible narrative is presented as certainty. The evidence here is strong enough without inventing the missing pieces.

Analytics was an observability signal after all

I had thought of web analytics as a publishing tool: readers, articles, referrals and trends. In this case it became delayed security telemetry.

An impossible growth spike was a symptom. Channel distribution showed that it was not search traffic. Source dimensions exposed the generated domains. Landing page and hostname connected the activity back to the compromised homepage. Engagement data showed that the traffic did not behave like an audience.

If I investigated a similar incident again, I would preserve evidence before cleanup:

• export acquisition, source, landing page, hostname, geography and device reports;
• retain raw web server access and error logs;
• save redirect responses and request headers from several networks and devices;
• archive modified configuration and application files safely;
• record database users, scheduled tasks and unexpected installations;
• rotate credentials only after preserving the timeline needed to understand their use.

The new static taamneh.com has a much smaller runtime, but Analytics taught me a lesson that applies beyond WordPress. Observability data collected for one purpose may become the only surviving record of another.

Those 11,000 visits were not my audience. They were evidence that somebody else had found a use for my domain.