Ghost Spam & Bot Traffic – Be a Ghost Buster

Ghost Spam & Bot Traffic – Be a Ghost Buster

Be on the Look Out for Ghost Spam

Many people don’t look beyond the Overview reports in their analytics tools, Google Analytics or other.

This is dangerous.  Ghost Spam is one reason you should definitely drill into your data, especially if you have a low traffic site or microsite.

To avoid making the wrong decisions (or looking stupid in front of your boss!), you must continuously check for ghost spam and bot traffic.  Why?  Because these troublemakers create misleading traffic patterns which can lead you to incorrect conclusions.

Take this pattern for example.

The spikes in traffic on July 8 and July 20 look really promising, don’t they?  Let’s say they sort of coincided with new marketing campaigns or social media posts you launched around the same time.  You might want to start cheering!  Curb your enthusiasm and check first.

Google Analytics OverviewUnfortunately, it turns out that the spikes are caused by ghost spam and that 48% of total traffic during this time has been created by meaningless referral sources such as asacopaco.tk and law-enforcement-six.xyz.

In the following image, the orange line is the real user traffic, and the green line is all ghost spam traffic (click on image to view a larger version).

Ghost Spam ImpactHow can you recognize ghost spam traffic?  The clearest criteria are:

  1. The hostname is not one of your valid websites – i.e. your website is not serving the hit to Google Analytics
  2. The screen resolution (or screen colours) are “(not set)” – i.e. this can’t be a real human visitor
  3. The referrer traffic source is one of a huge list of known spam sources

And the traffic for all of the above tends to have Bounce Rate and % New Sessions metrics of 100%.

Here’s a custom report that will allow you to identify ghost spam of type 1 and type 2 above (to create your own version, this report’s configuration is at the bottom* of this post):

Ghost Spam Custom ReportThere are unfortunately spam sources that pass neither of the tests above, so a separate segment must also be created to identify the bad actors of type 3. How do you know what to look for?

Well, this problem has now been around long enough and is not going away, such that there are people who have devoted time to trying to keep ahead of the spammers.

Loganix provides one tool – Subscribe to their continuously updated Google Analytics segment containing spammy sources, as explained in this post on ahrefs.  (This post also explains some of the technicalities of how this clutter shows up in your data).  If you find bad actors Loganix hasn’t found, tell them and they’ll add it to the next release.

The processes above are great for identifying problems.

But what can you do next to try and keep your data as clean as possible so that you don’t have to keep applying these segments?  What happens if a newbie analyst doesn’t know to apply these segments?

Adjust your Google Analytics Views.  Here are our suggestions:

  • Adjust your current “All Traffic” View so that it includes only your validated hostnames and excludes all spammy referrer sources. 
    • Keep analyzing this View for more ghost spam.  The only certainty is that there will be more spam
    • Make sure you tick the “Bot Filtering” checkbox in “View Settings” so that Google will “Exclude all hits from known bots and spiders”.  Google’s trying to make this better all the time, but they’re definitely not catching everything (yet).
    • WARNING: Mistakes in Views are irreversible!
      • Do NOT edit add new filters to your “All Traffic” view without testing.
      • Create a duplicate “All Traffic” View first.
      • Add the new Filters to the duplicate view
      • When you’re happy with the duplicate view, then apply the new filters to the “All Traffic” View.
  • Create a new View that includes all hostnames other than your validated hostnames (Ghost Spam View 1)
    • Keep an eye on this for unintended exclusions.  For example, someone may launch a new microsite and forget to tell you.  It’ll show up in Ghost Spam View 1.
    • An agency may be hosting a staging site on a different domain.  All your test traffic might end up in this View.
    • Shorteners like “ow.ly” from hootsuite may need to be included as valid hostnames, or you might miss some valid traffic.
  • Create another new View that includes all spam referring sources (Ghost Spam View 2)
    • Keep an eye on this also.  A new microsite might have a domain that happens to match your spam exclusion filter.  You’ll spot it here.
    • Whenever you exclude a spammy referring source from your “All Traffic” View, add it to this View.

When you sit down to think through this configuration, make sure you’ve got a good hour block of time.  You don’t want to mess this up!  Mistakes in View are not reversible.

And this isn’t a one time thing.  Continuous vigilance and ongoing analysis are necessary.

If this is helpful, please let us know.  And if you’ve found any other methods or tactics that work for you, we’d love to hear what works.

—-

Custom Report – Ghost Spam Detection

* Here’s the custom report configuration that generated the flat table “Ghost Spam” custom report shown above:

Ghost Spam Custom Report Configuration

 

By |2018-07-26T10:10:56+00:00August 2nd, 2016|0 Comments

Leave A Comment