How To: Block Spam Traffic From bot-traffic.icu In Google Analytics

TLDR:

Block/remove the spam using a segment which filters out traffic where the page title is (not set).

---

As a Google Analytics consultant I spend a lot of time looking around in GA to see what’s happening on a site. Whilst taking a look at my Google Analytics data yesterday, I got all excited about a huge spike in traffic over the weekend.  I’d been doing some blogging recently, so maybe it was that.  Or had there been a Google Core update maybe following some recent on site optimisation?  The anticipation was immense as I delved in for a deeper look.

Sadly, it was neither.

In this instance it was a case of referral and organic spam.

What is referral spam?

This is basically bogus traffic sent to your site to inflate and skew your traffic data.  The real question is “what is the point”?  I don’t really know the answer, I convince myself it’s just some nerd somewhere giving their self a false sense of power as they take revenge on a society that has shunned them. You know the type:

What is bot-traffic.icu?

In my case the spam came from bot-traffic.icu (no link, sorry) and when looking at the site, it redirects to this one:

Initially, I thought that perhaps someone had decided to carry out a negative SEO attack on my site – and to be honest, was that the case I would have felt a sense of pride and been flattered that I’d been targeted, but again, this wasn’t the case as a quick look on Twitter showed that I wasn’t the only one:

Heads up! If your analytics look too good to be true today, it's likely not because of a Google update. Many sites in our profile are seeing an attack of bot traffic Jan 31.

The spam site causing this promises you'll see more traffic in GA. 🤦‍♀️ pic.twitter.com/TkW3AlUHIy

— Marie Haynes (@Marie_Haynes) February 1, 2021

Hmm.. one of my sites currently has 1000+ users (analytics realtime) requesting /bot-traffic.icu (non-existing). Maybe a #DDOS @CloudflareHelp ?

— Michiel Kikkert 🅰️ (@Dutch_Guy) January 31, 2021

Hey @fighto, it's not just you.

My site just got hit by one today too. @googleanalytics can you please fix this? pic.twitter.com/rOsrpOaG78

— Joe Youngblood (@YoungbloodJoe) February 1, 2021

So, it looks like everyone got a hit, which makes me suspect that in answer to the question “what is the point?”, in this case it looks like Gamma Traffic are trying to demonstrate how effective their services are in the hope that someone will sign up to them.  If that floats your boat, go for it.   The rest of us have to deal with a load of shite data in our GA accounts.

How Do I Block Referral Spam?

This is straightforward enough, you set up a filter in Google Analytics as follows – test this by verifying to see if it would block your traffic:

There are two issues here:

1. This won’t remove any data already in your account, it will only block data moving forward
   
2. Spammers are agile, they can change the source at will

Point 2 has already happened, a client of mine also got a load of spam over the weekend from trafficbot.life

I haven’t had any spam from there yet, and can add this domain to my filter as follows:

But, years in the business has taught me the fight on spam never ends.

Don’t Forget The Bot Filtering Setting In Analytics

There is also a setting in GA that you should always ensure is ticked:

This will keep things tidy, but as it says it blocks from “known” bots and spiders.  Clearly gammatraffic is a new kid on the block.

What is Organic Spam?

Well, in essence it’s basically the same as referral spam – in this case the spam was evenly split between organic and referral:

How Do I Block Organic Spam?

Well, this isn’t as easy – the referral spam has a common denominator – the campaign source.  However, organic spam comes from a wide range of dimensions such as city, language, source etc.  So, if you try and block based on those dimensions, you may in advertently block real traffic.

Update 03/02

After much digging around I came across this tweet where it would appear the common denominator is “browser size” which is set to “(not set)”:

Google Analytics spam – what it was and what to do from the guy that wrote the Definitive Guide. https://t.co/XlsYQVqngr pic.twitter.com/VIchh0XczB

— Mike Sullivan (@AnalyticsEdge) February 3, 2021

This makes sense to me, in that if the spam is automated, then it wouldn’t have a browser size, so I have no qualms in creating a filter moving forward to exclude traffic where the browser size is not set:

Use Segments To View Historical Data Without Spam

Whilst you are unable to remove historical data from your analytics view, you can use segments to see what your data would look like without the spam.

To do this, click “Add Segment”, then set the advanced condition as follows:

Conditions:
Filter -> Sessions -> Exclude:
Browser Size -> contains -> (not set)
or
Source -> contains -> bot-traffic.icu

You can then apply that to see your “clean” data retrospectively – you can also sit it alongside the “All Users” segment to see your data with and without the spam – just to sense check that you’ve got rid of all the crap – as you can see, the spambots sent 1,427 visits over the last few days, the utter bastards:

Update 04/02

After reading this blog post looking for a solution, Marta Laurent from ForeverBarcelona.com got in touch to say that the above filters weren’t blocking the traffic as in her case the organic traffic was actually using varying browser sizes.

In her case, she noted that both referral and organic were being sent to a bogus page – /bot-traffic.icu, which in turn has page title as (not set):

This is a good spot, as it means both referral and organic spam can be filtered out with a segment to remove traffic where the page title is “(not set)”

How To Create Custom Dimensions for the Google Anaytics Platform API

If, like me, you use a custom 3rd party reporting tool such as DashThis which provides your data via the Google Analytics Platform API you can create filters to remove this data from your bespoke reporting dashboards as follows:

ga:browserSize!~(not set)|ga:source!~bot-traffic.icu|ga:pageTitle!~(not set)

So What Next?

There isn’t much you can do to permanently remove the spam from your data; it is forever skewed and your monthly report for January will come with caveats (or you could lie to your clients and take the glory).  All we can do is pray to the Google Gods that they find a way to remove this data from everyone’s analytics accounts, and we can just put it down to an anomaly then pretend it never happened. Until then, use segments.