Hi, I could use a little help with figuring out what is wrong here.

We have recently (the last four days) seen a giant increase in web traffic from the UK. Over this four day period, our uk servers has been visited by more vistors than we have had during our most busy month.

What makes us believe this is some kind of hoax is:
* None of the visitors have any HTTP referer set.
* They arrive evenly distributed over time. The traffic is the same during the night as during the busy hours!
* They all arrive at the index page and leaves the site within 1 second.
* They all accept session cookies.
* They all have different Internet Explorer UA strings. We have detected MSIE 5.5, 6, 7 and 8 from Windows XP, 2000 and Vista. Most of them have Google Toolbar detected in the UA string, but we are also seeing MySearchToolbar and a few other adware/spyware toolbars.
* Every single visitor views only one page (the index) and every IP address is unique and never returns.
* Normally 5-10 % of the visitors logs in as users, or creates and account. But now only 0,5 - 1 % does so.

This traffic is really disturbing as the servers tend to get overloaded during rush hours. Thus, we'd like to get rid of this obviously fake traffic, but we really don't know what is the cause of it or how to get rid of it. There seem to be no way to distinguish these visitors from "true" visitors other than the lack of a referer tag. But we are not ready to block all of the vistitors without a referer tag, as we have legitimate users without a referer set.

Any ideas?

Sounds like some kind of "botnet foraging", are the IPs from a similar range or distributed around different providers?

They are both distributed around a multiple of different providers and geolocations.

Are there any unlikely or impossible combinations of IE version and OS?

eg: IE6 or below on XP or above or IE7+ on 2000

That would then point to "Zombie" traffic rather than browsers being "hijacked" or maybe a misconfigured "PTC" bot (such as a mispelt hostname).