What is Spam Traffic?
Spam traffic is the presence of bots or other unwanted sources who send traffic to your website. While this traffic does not usually harm your website, it does skew your data by sending periodic spikes of users. It creates a false positive– making your website appear to have picked up a large amount of traffic overnight which should a red flag.
This raises the question— how do you identify spam traffic in your Google Analytics account?
Spam bots crawl each website page in a flash. In Google Analytics, you can spot bot activity in data with a 1.00 pages/session, a 100% bounce rate, and/or less than 00:00:01 session duration. Spam traffic is a dead giveaway if the number of pages visited on a site in a day skyrockets with the majority of them only indicating one pageview.
Why Do Spammers Send Bot Traffic in the First Place?
Spammers send bots to drive traffic to other sites in an effort to drive traffic back to their own website. They are counting on people seeing skewed numbers in Google Analytics, finding the source of the spam that is causing it, then clicking on the link to see their website. Upon entering the website, some will put affiliate cookies on your computer while others will receive payment for impressions. In the end, spammers are sending bot traffic in hopes of receiving traffic.
Places to Look in Google Analytics to See if Your Website Has Spam Traffic:
- User Traffic
- Location
- Service Provider
- Hostname
- Referral
- Browser Version and Size
User Traffic
Expand your date range by a few months to see if certain days received spikes in traffic. The reason for your spikes may be as simple as a well-performing email campaign or Google organic search feature tests. Don’t assume a spike is automatically spam–look at the page breakdown to see where traffic was coming from on the days with spikes. If a majority of pages on your website have just one pageview, there’s a high likelihood that spam traffic was present.
Location
Spam traffic tends to come from a server located in a single city. The easiest way to find where the spam traffic is coming from in Google Analytics is to look at Audience → Geo → Location. To start, look at the Country report to view any outliers. If one does not stand out, click onto your top trafficked country and select the “City” tab for a more in-depth look. Spam traffic tends to be one of the top listed locations since it sends a large number of users to a website.
An example of a location that is common to see spam traffic is Ashburn, VA, which is home to Amazon’s Web Service (AWS). The table below shows all users over a six month period that include Ashburn traffic, as well as an exclusion segment to show the difference in the data. Ashburn was responsible for almost one third of the traffic, drastically skewing engagement data such as bounce rate, pages/session, and avg. session duration.
Here is another example where a company located in the Eastern U.S. saw a massive quantity of traffic from Portland, OR. The Map Overlay in Google Analytics can be a useful tool in quickly identifying if traffic is flowing outside of target markets.
While location traffic helps identify where spam traffic is coming from, it is not the actual source of the spam. Because of this, use the spam’s location as a starting point to look further into the traffic coming from this area. Never use location as a filter in Google Analytics. There may be legitimate traffic coming from this area that should be taken into account. Use location as a way to look into which servers in the area could be responsible.
Service Provider
Find services providers in Google Analytics by going to Audience → Technology → Network → Service Provider. This usually uncovers the source of some of the spam traffic. Filter down to see which service providers have the lowest pages/session or avg. session durations. If these numbers are around 1.00 or less than 1 second, they likely contain data that should be filtered out. The Internet Service Provider, or ISP, is the closest we can get to filter down to an IP address in Google Analytics. Google does not allow targeting that goes deeper than this, so looking at the ISP gives insight into the possible server that spam is coming from.
Hostname
In the same Network tab, switch from Service Provider to Hostname. These should be variations of your website URL from subdomains and possibly your social media links. Any Hostnames that do not look like branded URLs or social media links may be possible sources of spam traffic. SEO service links are notorious for being spam Hostnames. Here are some we found on our own website:
- auto-seo-services.org
- autoseo-services.org
- autoseoservices.org
- backlinks-seo.org
- backlinks-seo.net
- 99-reasons-for-seo.net
Referral
Referrals coming into your website tend to be from social media and industry resources. Referral traffic is mostly positive, especially when it comes from link building efforts. Referrals are not good, however, when it originates from a spam source. Spam resources may cross over with those seen in the Hostname section and should be filtered out.
Browser Version and Size
Old versions of browsers that see a sudden spike in traffic should be looked into for spam traffic. If there are several advancements in browser versions, reverting to an older version doesn’t make sense for a human user. Bots may find success in crawling websites while still operating on an older version.
Browser size won’t be the reason for spam, but it helps detect it. Make Browser Size a secondary dimension under Browser to drill it down. If there’s one particular browser size that has high traffic but very low engagement, segment that browser size and see where the traffic is coming from and where it’s going for possible spam sources.
Who Else is Spam? You!
Believe it or not, you are most likely spamming your website without even realizing it. Sometimes you may check on a page, get in, and then get out. Other times you may spend an hour on your website and click on dozens of pages. This isn’t data that is relevant to your or your business, and can hurt your overall page traffic and engagement metrics. To counter this, place a filter on your Google Analytics account to remove the IP of your company.
Important Note: Do Not Visit Potential Spam Websites
There is a chance that spam websites may contain malware or other dangers. Do not visit a website to “check” to see if it is spam. Remember, the reason the spam was sent to you in the first place was to drive traffic back to the source website. Instead, search for a potentially spammy URL in quotes in Google search (“example.com”). This won’t take you directly to the website, but show the search results instead.
Generally, you’ll be able to tell based on the title and meta if a website is credible. If this isn’t an indicator, be forward and search “is [insert URL] spam?” and this will likely lead to forums, blogs, and other content that verifies this issue. There’s a more than likely chance you aren’t the first to encounter this spam traffic source.
How Does Spam Impact A Website’s Data?
Leaving spam traffic on a website can impact multiple site behavior analytics. These include skewing session duration, bounce rate, pages/session, and inflating users. Typically with the presence of spam traffic, you will see your site’s average session duration and pages/session drop and your bounce rate and users increase to above normal levels. It’s scary to think that business decisions are made based on unclear sets of data. Identifying and filtering out spam traffic provides a better view of user behavior in no time.
