This time of year, it makes more sense to get a visit from the Ghost of Christmas Past than the ghost you might be noticing in your Google Analytics traffic — ghost spam. Over the last few days we’ve gotten quite a few calls from clients asking about crazy referral traffic from even crazier sources, like, “Vitaly rules google ☆*:｡゜ﾟ･*ヽ(^ᴗ^)ﾉ*･゜ﾟ｡:*☆ ¯\_(ツ)_/¯(ಠ益ಠ)(ಥ‿ಥ)(ʘ‿ʘ)ლ(ಠ_ಠლ)( ͡° ͜ʖ ͡°)ヽ(ﾟДﾟ)ﾉʕ•̫͡•ʔᶘ ᵒᴥᵒᶅ(=^ ^=)oO,” “Secret.ɢoogle.com-Trump,” and “Congratulations to Trump and all americans.” To complicate matters even more it seems like the traffic is coming from places like BBC.com, The Washington Post and Google itself. If you’ve come across this in your analytics, you might be asking what is going on?
First: your site hasn’t been hacked or likely even compromised. This spam is mostly harmless. Its main purpose is to send fake traffic, also known as ghost referrals, to analytics. And while your site hasn’t been impacted by this, your traffic data may be skewed, which you’ll want to fix.
This Spam is Different
This particular type of spam, which has overrun analytics the last month or two, is different than the typical crawler spam you’ve probably blocked with an exclusion filter in the past. Unlike crawler bot spam, which does actually crawl your site and leave a record in analytics, ghost spam never gets to your site — just your analytics — which is how it earned its name. Sometimes the spammer has an agenda or message as with Vitaly Popov (the man behind the latest rash of ghost spam) sending out pro-Trump messaging and anti-Google messages, but the main objective is to inflate your traffic numbers.
The danger of skewed data depends on who you are.
- If you’re an SEO, your clients will want to know why they’re seeing a spike in traffic but not in sales. Or, why they are suddenly getting referral traffic from sites like The New York Post and The BBC.
- If you’re a web company, you might have to answer questions about how links with political messages are appearing on your clients’ sites (those links are not actually on the site, just in the Google Analytics).
- If you’re a site owner you may not notice where it is coming from at all and only notice the drop in (fake) traffic when it goes away.
Regardless of where you fall on that spectrum, blocking ghost spam is in your best interest.
How to Block Ghost Spam
- In Google Analytics, open the Reporting tab and choose Audience on the left side.
- Click Technology and choose Network.
- Scroll down and click Hostname at the top of the chart (highlighted in yellow below).
- Look through that list and pull out all of the valid hostnames for your site. This would be your sitename and any other site names that are associated with it. These are the only hostnames you will allow traffic from in your analytics.
- Go to the Admin panel in the upper right hand side of your analytics.
- Click the Filter icon in View, then add filter.
- Create new filter. Filter name: Valid Hostnames.
- Choose Include and then Hostname in the Filter Field drop down.
- You will need to create a regular expression for your domain. Enter the regular expression in the filter pattern box. *A regular expression is just adding all of your valid hostnames to the filter in a formatted way. Learn more about it here.
- Make sure you verify your filter before saving to make sure you’ve entered the regular expression correctly. Once you’ve verified, save and apply.
You should stop seeing new ghost spam within 24 hours of applying the filter.
Is this your first time hearing about ghost spam? You may have more questions. Send them our way!