The Government Copied My Google Analytics Code

[pageoneresults]

As you may know, any webpage that has the tracking code of your Analytics account installed on it will be tracked by your Analytics account. This is irrespective of whether it is your domain or not. The only way to stop tracking the page would be to remove the code from it, which you may have to contact the website owner for. Please be assured that this borrowing/displaying of tracking code is not common. In such cases, to avoid corruption of your own reports, you can use filters, as I mentioned in my previous email.

Did you know that?

Because a Webmaster working for the Karnataka Government copied one of our external js files which contains our Google Analytics Code, I now have access to 45 days (and counting) of their data.

I was always under the impression that GA ONLY worked from the domain or domains that it is verified for. That is not the case. I can take your UA and perform some major GA Corruption.

What else could I potentially do with your GA UA?

[Leosghost]

"The" clickbait "title" "title" Goes to P1R

Tips hat and raises glass ;)

[caribguy]

It's been discussed here before, kinda...

[webmasterworld.com...]

[pageoneresults]

Thanks for that reference caribguy. And thanks for the title title Leosghost. :)

I just finished reading the above reference and then the Google Support Forum topic. They're over there chasing a handful of ghost referrers. I happen to have a Government website sending me 6-8k referrers per day. It's been an interesting ride for the past 45 days.

[caribguy]

You can create an advanced segment to filter out that hostname.

[pageoneresults]

You can create an advanced segment to filter out that hostname.

Understood. Typically we will 403 referrers that we don't want. Those usually come from a link which can easily be manipulated by the destination, in this case, the 403. ;)

Personally? I want to see this stuff. I'm sure it has been happening on a small scale and I've never noticed it due to the sheer volume of referrers that are there. In this instance though, the footprint was quite obvious when my traffic nearly doubled overnight.

The questions I have is what type of associations can be formed through this process? I mean, could someone sabotage my Internet presence by associating my GA UA with a plethora of websites in bad neighborhoods? I know it can be used to corrupt my GA, what other nifty little tricks are folks doing with that UA?

I've figured out a few positive uses for this and it has to do with third party content. If I have a page on my site that is built for you, give me your GA UA and I'll include it on the page and you can have access to stats via your account. Just set up a filter and viola, you've got instant tracking. ;)

[caribguy]

I thought you were saying that they swiped an external .js that includes your analytics snippet. If they're hosting it, a 403 for their referrer won't help you much (unless the code references something on your host).

Since excluding their host in your analytics website profile won't filter out past data, you're stuck with using an advanced segment. Agree that it's probably only happening on a small scale, I'm seeing no more than .01% of this type of background noise. If it starts skewing the stats, I'd just filter it out.

Not sure that I follow your fear of association with bad sites: from the email you quoted on your site, it appears that Google is well aware of the fact that anyone can copy the UA (and potentially abuse it). Your traffic selling example makes sense, but that's probably only one of the many ways to befuddle a naive SEO customer.

In case the Karnataka website is also using Analytics, do their stats now undercount the amount of traffic? What happens if your UA snippet loads before theirs (or viceversa)? By default, only the first UA is tracked. (See here [webmasterworld.com] for a workaround)

The Analytics API provides tools to track pages over multiple domains: [code.google.com...]