How Bot Traffic Was Hurting NFL Draft Buzz's Ad Revenue and how we fixed it

What started as confusion over unexpected analytics quickly turned into a problem that was seriously affecting our advertising relationships. Here's how bot traffic from Boardman, Oregon became a major headache, and how we solved a problem that's affecting thousands of websites worldwide.

When "Good" Traffic Goes Bad: Warning Signs Every Website Owner Should Know

Picture this: you've been building your reputation with comprehensive player rankings and detailed scouting reports, maintaining steady growth and advertiser relationships. Then suddenly, during the NFL's quiet period in early summer - normally our lowest traffic time of year - your user total increases by 400 percent over the span of a month. This timing made the spike especially suspicious. Initially, this seemed like it could be organic growth - perhaps our player evaluations were gaining more traction during the slow news cycle, or we'd been featured somewhere that drove legitimate traffic.

But something was very wrong. Our average session duration had dropped massively, and the data revealed a shocking pattern: 75 percent of our traffic had a visit time of exactly 4 seconds. Four seconds! That's barely enough time to read a player's name, let alone absorb any meaningful scouting analysis.

This wasn't just disappointing - it was seriously affecting our advertising revenue model. Our advertisers started expressing concerns. One sponsor told us, "Your audience engagement numbers don't look good – nobody's sticking around to actually read anything." That was concerning, especially when we'd worked to build relationships with advertisers who valued our engaged audience.

Understanding Bot Traffic: A Problem Affecting All Website Types

After digging into our analytics, we discovered something alarming. A massive 75% of our traffic was coming from Boardman, Oregon – a town with a population of 3,500. Unless every single resident had suddenly become obsessed with NFL draft coverage, something was very wrong.

Google Analytics painted a disturbing picture: thousands of "visitors" from this tiny Oregon town, all spending exactly 4 seconds on our site before disappearing. Our bounce rate was through the roof, and our real audience was buried under an avalanche of fake traffic.

The worst part? These weren't real readers engaging with our player rankings and scouting reports. They were bots, systematically scraping our player evaluations – probably to feed AI systems or resell our research elsewhere. All that work we put into detailed prospect analysis and rankings was being stolen by automated programs that couldn't care less about the quality of our scouting.

This problem isn't unique to sports websites. We later discovered that content sites across all industries – from tech blogs to cooking websites to financial advice platforms – are dealing with similar bot attacks. The pattern is always the same: massive traffic spikes from unusual locations, impossibly short session durations, and analytics that make legitimate websites look like they have terrible content when the opposite is true.

Other website owners report similar attacks from various locations including Ashburn, Virginia; Columbus, Ohio; Montreal, Canada; and other cities that house major data centers. The common thread isn't the geographic location – it's that these are all areas with large server farms and cloud hosting infrastructure that bot operations exploit.

Understanding the Amazon Connection

Here's where things got interesting (and infuriating). After researching further, we learned that Boardman, Oregon isn't just a random small town. It's home to massive Amazon Web Services data centers. Our bot problem wasn't coming from enthusiastic Oregonians – it was coming from professional scraping operations using Amazon's cloud infrastructure.

These bot operations were systematic and relentless. They'd hit our site, grab whatever player rankings and scouting reports they could, and move on to the next target. No engagement with our prospect evaluations, no time spent reading our detailed analysis – just cold, calculated content theft. It's like having someone steal your draft board and then use it to make terrible picks.

The frustrating part was discovering how common this problem is. We found forums full of website owners dealing with the same "Boardman, Oregon" issue. Apparently, we weren't the only ones getting hammered by bots from Amazon's data centers.

Finding the Right Defense: Cloudflare Pro Setup Guide

Fighting bots with basic tools is like trying to stop a modern offense with outdated equipment – you're simply outmatched. We were on Cloudflare's free plan, which offers minimal bot protection.

The upgrade to Cloudflare Pro ($20/month) gave us access to real weapons: advanced bot detection, custom security rules, and the ability to block entire networks instead of playing whack-a-mole with individual IP addresses.

(And before you ask - no, Cloudflare isn't paying us to say this, though we'd happily accept their sponsorship if they're reading!)

Step 1: Upgrade to Cloudflare Pro

• Log into your Cloudflare dashboard
• Navigate to your domain
• Look for "Plans" in the top navigation
• Select "Pro" and choose monthly billing ($20/month)

Step 2: Configure Super Bot Fight Mode

• Go to Security → Settings
• Find "Super Bot Fight Mode"
• Change these critical settings:
  • Definitely automated traffic: Change from "Allow" to "Block" or "Challenge"
  • JS Detections: Turn "On" (detects bots that can't run JavaScript)
  • Static resource protection: Turn "On" (protects images, CSS, JS files)
  • Verified bots: Leave as "Allow" (don't block legitimate search engines)

Step 3: Create Custom Security Rules

• Go to Security → Security Rules → Custom Rules
• Click "Create Rule"

Rule 1: Block Amazon Networks (Most Important)

• Rule name: Block Amazon ASNs
• Click "Edit expression"
• Enter: (ip.geoip.asnum eq 16509 or ip.geoip.asnum eq 14618)
• Action: Block
• Deploy the rule

Rule 2: Block Specific Problem IPs (if you identify them)

• Rule name: Block Bot IPs
• Expression: (ip.src eq 1.2.3.4 or ip.src eq 5.6.7.8) (replace with actual IPs)
• Action: Block

Rule 3: Challenge Suspicious User Agents

• Rule name: Challenge Bot User Agents
• Expression: (http.user_agent contains "bot" and not http.user_agent contains "googlebot")
• Action: Challenge (gives them a test to prove they're human)

Here's the key insight: instead of trying to block "Boardman, Oregon" (which requires Cloudflare's expensive Enterprise plan), we went after the root cause. Using something called ASN (Autonomous System Number) blocking, we could target Amazon's entire network infrastructure. Think of ASN as a network neighborhood – instead of blocking individual addresses (IP addresses), we blocked Amazon's entire neighborhood.

The technical details might sound complex, but the concept is simple. One rule to handle the entire problem: (ip.geoip.asnum eq 16509 or ip.geoip.asnum eq 14618) – which translates to "block everything coming from Amazon's servers."

Multiple Lines of Defense

We didn't rely on just one strategy. Along with the Amazon network block, we set up additional rules to catch any remaining threats:

Rule #1: The Amazon Block
Blocked all traffic from Amazon's server networks. This was our primary defense against the bulk of the bot traffic.

Rule #2: Specific IP Targeting
We identified the worst offending IP addresses and blocked them specifically.

Rule #3: User Agent Filtering
Blocked obvious bot signatures in their "user agent" strings – basically, bots that weren't even trying to look human.

The beauty of Cloudflare Pro is that you get 20 custom security rules (versus 5 on the free plan), plus much more sophisticated bot detection. It's a significant upgrade in terms of what you can accomplish.

The Results: Sweet Victory

The results exceeded our expectations. Within 24 hours, our traffic dropped from 157,000 fake requests to real numbers. Initially, we panicked – had we broken something? It felt like watching your team's stats after trading away all your star players.

But then we looked at the quality metrics. Our average session duration jumped from 4 seconds to over 2 minutes. Our bounce rate went from terrible to respectable, like a defense finally learning how to tackle. Most importantly, our traffic sources now showed what they should: real people finding our site through Google searches, direct visits, and other legitimate sources.

The real victory came when we contacted our advertisers. Instead of apologizing for poor engagement metrics, we could show them clean, quality data proving our audience actually cared about our player rankings and scouting reports. One sponsor said our new metrics looked "like a completely different website" – and they were right. Our advertising revenue was back on track with metrics that actually reflected our real, engaged readership.

Ongoing Monitoring: Staying Ahead of the Game

Bot operations evolve constantly. These digital threats don't just give up – they adapt and try new tactics. That's why someone on our team now does weekly monitoring, checking analytics for new suspicious patterns.

Our routine is straightforward but effective:

• Check Google Analytics for unusual geographic spikes
• Monitor Cloudflare's security dashboard for new threats
• Watch for session duration drops or "unknown browser" increases
• Keep an eye on new hosting providers showing up in our traffic

It's like maintaining your defensive game plan throughout the season – the fundamentals stay the same, but you've got to adjust for new threats.

Key Takeaways: Lessons for Any Website Owner

If there's one thing we learned from this experience, it's that bot traffic can completely destroy your website metrics regardless of your industry or niche. Here are the key lessons that might save other site owners from similar problems:

Trust Your Instincts: If your traffic looks too good to be true, especially during typically slow periods, it probably is. Real visitors don't spend exactly 4 seconds on every page – they stick around to read your content.

Invest in Real Protection: Free security tools have serious limitations. The $20/month for Cloudflare Pro was one of the best investments we made for NFL Draft Buzz, and it would be just as valuable for any content-driven website.

Target the Source: Instead of fighting individual bots, attack their infrastructure. Blocking entire networks is far more effective than trying to stop each bot individually.

Monitor Continuously: Keep watching your metrics closely. Bots adapt their tactics, and your defenses need to evolve too. Set up alerts for unusual geographic spikes or dramatic changes in session duration.

Quality Over Quantity: We'd rather have real visitors who actually read our content than thousands of bots inflating our numbers. Advertisers and business partners care about engagement, not empty statistics.

Look for These Warning Signs:

• Traffic spikes from small towns or unusual locations (Boardman, Oregon; Ashburn, Virginia; Columbus, Ohio; Montreal, Canada are commonly reported)
• Massive increases in "Unknown" browsers or operating systems
• Session durations under 10 seconds across large portions of your traffic
• High bounce rates combined with increased traffic volume
• Geographic patterns that don't match your typical audience
• Traffic increases during typically slow periods for your industry

Moving Forward

Looking back, dealing with this bot traffic issue was actually helpful. It forced us to understand website security better and upgrade our defenses. Our analytics are now clean and accurate, and our advertisers are happy with the genuine engagement metrics.

If you're seeing weird traffic patterns, it's worth investigating. The Cloudflare Pro upgrade worked well for us, though there are probably other solutions out there too.

For us at NFL Draft Buzz, this whole experience reminded us that protecting our player rankings and scouting reports matters just as much as creating them. Now we can get back to what we do best: evaluating prospects and debating whether that small-school linebacker really deserves a first-round grade.

And if you ever see a massive traffic spike from some random small town, remember our story. It's probably not because you've suddenly gone viral in rural America – it's more likely that you've attracted some unwanted digital attention that needs to be addressed quickly and decisively.