AdWords is now Google Ads. Our new name reflects the full range of advertising options we offer across Search, Display, YouTube, and more. Learn more

Analytics
2K members online now
2K members online now
Learn to identify referral spam traffic, as well as best practices to reduce referral spam in your Google Analytics account
 
Guide Me
star_border
Reply

Block Google Analytics ghost spam with hostname = (not set)

Google Employee
# 1
Google Employee

This popular discussion was copied from the former Help Forum, answered by Whims (TC)

 

Question: My Google Analytics is being spammed by a botnet and I need to filter out these ghost sessions. They all seem to be direct acquisitions and have hostname = (not set) so it should be easy to filter them out, however this doesn't seem to work because of this rule (https://support.google.com/analytics/answer/1033162?hl=en): 

 

Fields specified in a filter must exist in the hit and not be null in order for the filter to be applied to that hit. For example, if you are filtering on Hostname, but the hit does not contain that field (perhaps the hit was sent via the Measurement Protocol and that request did not contain the &dh parameter), then any filters acting on Hostname will be ignored and the hit will be processed as if there was no filter.

 
This is absurd. My analytics are being ruined by these ghost sessions and there doesn't seem to be a way to stop them since an empty hostname is the only identifying field I can find (the rest of the fields seem normal except for a couple others that are also (not set)). I have tried both excluding empty hostnames and including only my own domain, but neither of these filters work. The inability to check for a non-existent field basically gives the ghost spammer a free pass. There needs to be a way to filter these out.
 
Answer: 
Thanks for your your response. I set a filter earlier to include only hostname for my domain, however from the filter verification results and the language from the page I quoted in the OP, I got the impression that this would not apply to all the spam sessions without hostname set. Will this work for the ghost spam even if they have no hostname? 
To the best of my knowledge it should be fine with a single include filter for your hostname. 
If you have applied a valid hostname filter to only include your hostname, then you are not filtering hits with (not set),
you are filtering hits with the valid hostname in the hit that is for your own domain name etc which is a valid host
 
The filter verification results are not always user friendly/intuitive. When you use the filter verification on the left side of the table it will show you all the hostnames that would be included without the filter applied (where it gets confusing is if say your include filter is for mydomain.com then it wont also include that in the left side of the table as having data already collected for it over past 7 days) and then on the right side of table, the results should be all blank, to show that the data for the hostnames on the left side will no longer be included if this filter is used.
2 Expert replyverified_user

Re: Block Google Analytics ghost spam with hostname = (not set)

Google Employee
# 2
Google Employee
If you have any questions, post them below, or start a new discussion.

Block Google Analytics ghost spam with hostname = (not set)

Visitor ✭ ✭ ✭
# 3
Visitor ✭ ✭ ✭

What if instead of hostname "not set" it just says "there is no data for this view"

how can I possibly filter a not non-nonexistent hostname???

Block Google Analytics ghost spam with hostname = (not set)

Visitor ✭ ✭ ✭
# 4
Visitor ✭ ✭ ✭

There is a tool for this and it works great. Also, it's free! You want to not only build filters for this spam and ghost traffic, but you also want to segment out anything that got in. Here is how I use the tool: https://megamikejr.com/blog/seo/remove-block-spam-traffic-google-analytics/

 

Block Google Analytics ghost spam with hostname = (not set)

Rising Star
# 5
Rising Star

Hi @Devon R,

 

You should see at least 1 hostname (your domain) if your code is working properly,

 

If you don't see any data in the hostname view, either a segment is filtering all data, your tracking code is not correctly installed or you are seeing a recently created view.

 

To check if your code is correctly installed you can use this chrome extension

https://support.google.com/analytics/answer/1008083

 

If it is correctly installed then check an older view, if you only have one view, then wait a few days and your hostname report will populate.

 

Hope it helps

 

Google Analytics Rising Star | Was my response helpful? If yes, please mark it as the 'Best Answer.' Learn how here!
Analytics Consultant at Carloseo.com - Find me on Twitter | Email me