Saw a spike for one site today in "direct" traffic.
When I dug down into "network source", Google Analytics shows "googlebot.com". Browser shows as "Googlebot".
My first thought was that someone was scraping, and somehow appearing to be from the network source of "googlebot.com". However, the apache logs show that all of today's visits from anyone with a user agent containing "Googlebot" are coming from Google's 66.249.7X.XXX network. So, it's not someone spoofing the UA. Also, it wouldn't be trival to spoof "network source".