Ghost Spam using legitimate hostname
When looking through the solutions online for blocking and filtering spam in GA, I came across a lot of solutions. This MOZ solution being the one I found easiest to understand.
The problem that I have is that when I look in my own GA, these spam bots appear to have a legitimate hostname that is the same [censored] some of my main traffic. Does mark this fix as ineffective and are these spammers getting smarter? Or am I missing something? ... is there another solution?
Re: Ghost Spam using legitimate hostname
Unfortunately, the spammers are getting more sophisticated. It would be nice if GA would block them automatically but alas, they would just open up shop under a new domain.
While I did not follow the MOZ link, best practice is to have an include filter for your hostname and I'm sure it says something like that and it sounds like you've done it.
Now you will need to layer in exclude filters for campaign source with the pattern matching the offending site. This would be under Advanced>>Exclude>>Campaing Source so if the traffic was coming from IHaveNoBusinessPlanSoISpamPeople.com you would add this in as the pattern. You can also add more than one to one filter with a pipe | . Purists (like me ) would have you escape the dot . with a slash so the .com would be \.com. It works either way but escaping is best practice.
Hope that helps.