Analytics
5.3K members online now
5.3K members online now
Learn to identify referral spam traffic, as well as best practices to reduce referral spam in your Google Analytics account
 
Guide Me
star_border
Reply

Direct Ghost Spam using [mydomain.com] as hostname

Visitor ✭ ✭ ✭
# 1
Visitor ✭ ✭ ✭

Hello Everyone,

 

I thought I figured out what was causing the huge increase in traffic. It is Ghost Spam and this is all the data I have documented on it for this client.

 

I first noticed the direct traffic increase happen on July 5th of 2015. This spike is clearly seen in GA.

Ga spike 7_5.png 

Since I was able to isolate this down to a specific day I dove into the data to figure out what was going on. I first found something very strange.

 

Here is what their direct traffic looked like from 1/1/2015 – 6/30/2015

 first half.png

 

And here it is 7/1/2015 – 12/31/2015

 second half.png

Once I was able to isolated to a specific browser I wanted to see more statistics of this group of “users”. The first thing I noticed was average session duration and bounce rate.

 IE dive.png

Looking at this data IE versions 10 & 11 seem like real users. My first thought was maybe this traffic was coming from an IP address or a range that we could filter out. The server logs did not match that theory.

 

So far I knew 2 things were absolute: the traffic was coming from IE and it started on the 5th of July last year. I then started looking for other trends and correlations in the data. I then noticed the third data point.

 last but not least.png

This is a huge indicated for referral spam. Since this wasn’t coming from referral traffic I narrowed it down to ghost spam. Another funny thing was my client was not the only one to have this happen on July 5th, from this flash version & with a near 100% bounce rate.not alone.png(https://www.en.advertisercommunity.com/t5/Referral-Spam-Traffic/Huge-amount-of-quot-fake-quot-visito... & (https://www.ohow.co/common-causes-of-unnatural-spikes-in-direct-traffic-google-analytics/)

The best way to fix this (i thought) would be to create an entirely new GA account. 

 

Well several days later on the new account it is back. How do I stop this direct ghost spam for good. It is using the same hostname as my domain so I can't filter that out. 

I am honestly going crazy trying to figure this out any ideas you all have will greatly help me out!

2 Expert replyverified_user

Re: Direct Ghost Spam using [mydomain.com] as hostname

Rising Star
# 2
Rising Star
Hi Jacob,

A new account will not stop it - as you have found out. You need to do a few things:

Create a new filtered view (always leave one to collect all data). In the view settings, select the tick box for exclude known bots and spiders.

Create an "include" filter based on hostname and a filter pattern matching the domain. (example\.com)

Keep a lookout for the traffic again and for any other commonalities on which you can filter. Smiley Happy

Best,

Theo Bennett
Analytics Evangelist at MoreVisibility | Contact Me
Connect on LinkedIn

Re: Direct Ghost Spam using [mydomain.com] as hostname

Visitor ✭ ✭ ✭
# 3
Visitor ✭ ✭ ✭
Hi Theo,

My issue is that if i include the domain (mydomain/.com) I will also get the spam. That is the host name it is using. I have also ticked the box for known bots and spiders ages ago on the old view and it did not change the data.

Re: Direct Ghost Spam using [mydomain.com] as hostname

[ Edited ]
Participant ✭ ✭ ✭
# 4
Participant ✭ ✭ ✭

Hi Jacob,

You should read that topic: https://www.en.advertisercommunity.com/t5/Referral-Spam-Traffic/Greetings/m-p/591292#M854

I described there step-by-step how to block bot traffic. Smiley Happy

Hope that it helps.

Taavi

Re: Direct Ghost Spam using [mydomain.com] as hostname

Visitor ✭ ✭ ✭
# 5
Visitor ✭ ✭ ✭
Hi Taavi,

Thanks for the information but this also does not work. the hostname is www.clientdomain.com so I can't filter by hostname.

Re: Direct Ghost Spam using [mydomain.com] as hostname

Participant ✭ ✭ ✭
# 6
Participant ✭ ✭ ✭
So the hostname is www.clientdomain.com.

What is the source / medium of this bot traffic? Is it possible to figure out? You can also filter it out.

Taavi

Re: Direct Ghost Spam using [mydomain.com] as hostname

Visitor ✭ ✭ ✭
# 7
Visitor ✭ ✭ ✭
Correct. It is all coming in as (direct) / (none)

Re: Direct Ghost Spam using [mydomain.com] as hostname

Visitor ✭ ✭ ✭
# 8
Visitor ✭ ✭ ✭
I have researched and it seems that this issue has never been fully fixed. The closes i got to a fix was https://www.ohow.co/common-causes-of-unnatural-spikes-in-direct-traffic-google-analytics/ but there is still stragglers left from this.

Re: Direct Ghost Spam using [mydomain.com] as hostname

[ Edited ]
Participant ✭ ✭ ✭
# 9
Participant ✭ ✭ ✭

Jacob, do you have anything added to the referral exclusion list except your own domain?

It's pretty hard to say how to block this traffic without the account access. You should drill down even more and create custom segments in order to find the root of the problem, then you can just filter out the right thing. I see that you've already used segments but probably you can dig even deeper. Smiley Happy

Even if you create a new GA account, I guess it doesn't help. And even if it helps, you'll probably run into the same problem later. You'll need to find a way to filter out this bot traffic.

Re: Direct Ghost Spam using [mydomain.com] as hostname

Visitor ✭ ✭ ✭
# 10
Visitor ✭ ✭ ✭
I have nothing in the referral exclusion list. I am not even using the clients domain in there because I don't want to disregard all traffic from my own domain. Also this spam is not coming at all from referral. Wish it was because that would be a whole lot easier to filter.

I have drilled so far down that i'm in the roots not "the weeds" anymore. I just feel there should be a way to stop the collection of ghost spam. I have even contact Google (with low expectations) and was told to just tick the box for bot filtering and that it should work.