Referral spam: when your analytics lie

This is called referral spam, and it is more widespread than you might think. A good reason to take a closer look at the technique: how to recognise it, what it distorts in your decisions, and what to put in place so you don’t discover it three months too late.

What is referral spam?

A referrer is the site a visitor comes from when they click a link. Referral spam consists of making a domain show up in that list through fake visits, so that the site owner, intrigued, goes and looks at that domain.

It comes in two forms:

Ghost spam never reaches your site. The bot sends fake signals straight to Google’s servers, using your site’s measurement ID, which is publicly visible. Blocking anything on the site itself changes nothing.
A real bot actually loads your pages. It leaves a trace on your server, and a server-side block stops it.

Both produce the same lines in your reports. The difference matters when it comes to choosing a remedy, and the case below shows why.

Two spikes in two weeks, one fake and one real

Let’s set the scene first. Our client, a well-known institution in the performing arts, has a classic showcase website with a ticketing system.

The site mainly promotes its shows (and lets people book their seats), its season passes, and the life around this landmark Brussels venue.

As with any cultural venue, we know roughly what to expect in terms of website traffic, and we can identify the busy periods across the year.

This summer, however, Google Analytics flagged two anomalies. In late July, nearly 700 visitors when about a hundred were expected. On early August, nearly 1,000 visitors when 300 were expected.

From a distance, the two bumps look alike. Yet the first one is manufactured, and the second matches the opening of ticket sales for the new season. Without checking, you make one of two mistakes: believing both spikes, or dismissing both and erasing a real audience success. For a team that does its job remarkably well, that can be frustrating.

This spam makes your numbers look better

We tend to picture fake traffic as zero-second visits. Here we found the opposite: the fake sessions behave better than the real ones.

For example, the site trafficheap[.]cc showed nearly 500 sessions with a 98% engagement rate (!) and an average engagement time of 40 seconds. Meanwhile, Google searches accounted for 145 sessions with a 65% engagement rate and 21 seconds of engagement time.

The bot imitates an ideal visitor: it stays 40 seconds and triggers about six events per session, just like a human. Someone who checks their statistics once a year would see rising engagement and be pleased about it.

But the purpose of these bots is to draw your curiosity towards something: a fraudulent web page, or services that are not entirely above board. The name is not always as telling as the one in this case. So you see an unknown domain, you visit it to understand, and bam, you land (in this instance) on a fake-traffic seller. The first rule is therefore simple: do not visit a domain that looks suspicious (because of its name or its statistics), and never link to it.

Three tests to tell a fake spike from a real one

These three checks can be done in the standard Google Analytics reports, with no technical skills.

The share of new visitors. A bot has no history, so it always shows up as new. A real spike also brings back your regulars, and is often tied to a communication event (an announcement, a redesign, some buzz…).
Concentration on an unknown source. A real spike is spread across your usual sources. A fake spike sits almost entirely in a domain you have never seen.
Behaviour that is too regular. Hundreds of sessions all landing on the home page, from a single country unrelated to your audience, with near-perfect engagement.

Criterion	Late July (fake spike)	Early August – Announcement
Active visitors	+/- 700	+/- 1,000
Share of new visitors	96%	49%
Returning visitors	26	513
Sessions from trafficheap[.]cc	500	0
Top source of the day	trafficheap[.]cc, 72% of sessions	Google search, 75% of sessions

The impact on how you read your data

Over the days observed, spam accounts for no more than 10% of sessions. The problem lies in where it concentrates, which ends up skewing the analysis.

Year-on-year comparison. Next year, the start of the season will be compared with a period inflated by nearly 500 sessions. A normal result will look like a drop.
Reading your partnerships. The “referral” channel turns out to be almost entirely spam. The real relays (partners, event listings, local press) therefore weigh very little.
Quality averages. A block of sessions at 98% engagement pulls every indicator upwards and hides any pages that perform less well.
Evaluating the announcement. If the fake spike falls close to a communication, you credit it with an effect it probably did not have.

Ghost or real bot: the question left unanswered

To find out which form you are dealing with, you need to search for the domain in the server access logs, over the period concerned.

A result close to the number of sessions points to real visits, so a server-side block is useful. Zero points to ghost spam, which only a filter in your reports can set aside.

In this case, we could not settle the question. The anomaly was spotted three months later, and the server logs were no longer available. That is why the first of the measures below is an alert: it leaves time to check the logs while they still exist.

Got referral spam too? Here are six concrete measures:

Create an alert. In Google Analytics, a custom insight sends an email when the day’s sessions exceed a threshold. You learn about the anomaly within 24 hours instead of three months. It also lets you check straight away that the site is not actually under a security attack.
Annotate the polluted period. A note on the anomaly prevents anyone from comparing this spike with the following season without knowing.
Exclude the source from your steering reports. A filter “source does not contain trafficheap” in the dashboard gives the corrected figure: x real sessions on the end of July, instead of +/- 700.
Tag every announcement. UTM parameters on the links in your newsletter and posts sign the real spike. Without them, those visits fall into “direct”, with no way of knowing which ones came from the announcement.
Measure an action that matters. A click to the ticket office tracked as a key event is an indicator that this kind of bot does not inflate.
Extend data retention. The default setting is 2 months for detailed analyses. It can be raised to 14 months in one click, in the admin settings.

Conversely, the “unwanted referrals” list in Google Analytics, which is often recommended, does not remove these sessions. It reclassifies them as direct traffic, where they become invisible.

Our recommendation would rather be a structural solution: a measurement tool whose data collection goes through your own server, such as self-hosted Matomo. The fake signals sent to Google never reach it, and your visitors are no longer tracked by a third party. A double win in our view, as a studio for whom the commitment to ethical digital practice is a real choice.

Watching your data is a job in its own right

However much you would like to, you don’t always have time to keep watch, and that’s normal. The client in this case did not see the anomaly. They were preparing their season and their communication, which is their job. Reading statistics and knowing which spike counts is another job: ours. Our digital consultancy offers this kind of precise analysis in a dedicated session: a check of your statistics before and after each major announcement, with alerts configured and a one-page report giving the corrected figures, and the ones you can truly be proud of.

Cover credit: Photo by Jakub Żerdzicki on Unsplash