This fake traffic site sending visits

[born2run]

Hi My Apache website had a sizeable number of hits from this website example.club

Anyone have some experience dealing with this fake traffic service? Thanks

[edited by: not2easy at 3:57 am (utc) on Apr 12, 2021]
[edit reason] Please no specifics (ToS) [/edit]

[not2easy]

Sorry for the edit, but to quote the Charter:

Please do not post specific details such as domain names, full IP addresses, or personally-identifiable information such as name, e-mail address, IM screen name, etc. Such specifics will be edited or removed in accordance with our Terms of Service [webmasterworld.com...] which may render your post meaningless.

[not2easy]

Can you examine your logs to see whether any patterns show up in UA or IP ranges? How do you determine what service is sending this fake traffic? If it is due to referers (sic), you can block the referer.

[born2run]

Yes it's seems to be appearing in the "Keywords sessions" nowhere else.

[born2run]

Like 300 plus keywords mentioned, same keyword btw

[lucy24]

Yes it's seems to be appearing in the "Keywords sessions" nowhere else.

How does this relate to Apache? And how can you tell it isn't simply garden-variety referer spam? I find various “example.club” now and then attached to image requests, but as long as it's just images, the hotlink routine can deal with them.

[born2run]

Now I am looking at the apache logs and I don't find any reference to "example.club" referrer. Now what I should do to track which IP address is doing this? I suspect I'd have to look by timestamps? The logs are in UTC and I'm in a different timezone.

[NickMNS]

There is no IP address doing this, it is referral spam. The "attacker" is making requests directly to your Google Analytics endpoint without ever going to your website. You can set a filter in GA to only show hits from your domain, that is where the hostname === your domain.

[lucy24]

Now I am looking at the apache logs and I don't find any reference to "example.club" referrer.

Aha. This isn’t an Apache issue at all; it’s an analytics issue. This is why we are always nagging at people to check their server access logs. If something is present in analytics, but not in the server logs, then it has nothing to do with your site. (Yay! Your server doesn’t have to do extra work.) Instead, they are sending requests directly to GA to make it look as if they’re visiting your site. Since third-party analytics such as GA aren't subject to your own site's access controls, all you can do is configure GA to ignore them.

:: insert boilerplate about advantages of using an analytics package that lives on your own server ::

[born2run]

Ok Nick thanks can you point me to a guide on how to set this GA filter? Thanks

[born2run]

Ok guys I did some Google searching and found a guide to filter out by domain and specific spam site. However even now when I goto Google Analytics reporting I see the "hits" from that spam site example.club. What could be wrong?

[born2run]

I also see that the referral sources data in this case is appearing as "Google" Now what? :)

[not2easy]

to filter out by domain and specific spam site

Read again what NickMNS offered, it is instructions:

You can set a filter in GA to only show hits from your domain, that is where the hostname === your domain.

That is not the same as filtering by the referer spam domain. If the hostname is not your own then GA should not count anything from the scripted pings from that 'club' domain. The idea is to set GA to only count visits from your domain so that hits from scripts won't be counted. ;)

[born2run]

Ok I did set the filter for including hostname = domain\.com. It seems the filter takes effect in around a day I read.

[born2run]

I'll check tommorow guys. thanks so much! :)

[born2run]

Hi how many hours does it take for new filters to work? Thx!

[phranque]

how many hours does it take for new filters to work?

i'm pretty sure you'll get more/better answers to GA questions posted in the Website Analytics - Tracking and Logging [webmasterworld.com] forum.

[NickMNS]

Ok guys I did some Google searching and found a guide to filter out by domain and specific spam site.

Do not filter out specific spam sites. You need to filter all traffic with a hostname that does equal your domain.

To do this:
Step 1: create 2 new views such that you have 3 views.
View 1: All data view, that has no filters.
View 2: Master view, the view that you should use for day to day activities.
View3: Test view, this should be a copy of the Master view but for which you can add new filters and other options to test out without causing any interruptions to your regular data stream.

To do this go to the admin panel and click the "create view" button. Since you are setting this is the first time you set this up you don't have any "master" data to interrupt, so just create the "master" view and then when satisfied clone it to create the test view.

Step2:
In the "master" view click on the "filter" icon, then "add filter",
give you filter a name,
select filter type "predefined, and "include",
select source or destination "traffic to the hostname",
select expression "that are equal to" and then
hostname to your domain "example.com"

That is it, click save and your good to go.

While you are there you may want to add other filters:
I filter my own IP address you can also filter the IP's of other collaborators.
And "redundant host" filter that will consider www and non-www as the same. I not sure if this is needed if you are already redirecting non-www to www or vice versa, but I have it in my filters despite using redirects (it may be a legacy of pre-https, pre-redirects).

Remember that you still have the "all-data" view, so you can easily see what is going on without any filters applied, by selecting that view. And you will have the "test" view so if you want to add new filters, or goals or other options you can add them to "test" view first and port them to the master if you decide to keep them.

[NickMNS]

I have some bad news. I just got hit by the domain.club spammer. The hostname filter is not stopping the spam. I'm not sure if this is a bot hitting the website directly or referral spam hitting GA only. I haven't checked my logs. But what is clear is that they are changing the UA for each hits, as GA shows them coming from different cities, devices and operating systems etc, but they all show the spam domain as the keyword and Google as the referrer. But this is obvious spam because if the traffic really came from Google the keyword may appear only a few hits.

[born2run]

Yes nick and their website is visible too if u visit example.club in your browser. I tried to find out where these guys are located but they have masked their website front quite well. Would like to see what solutions you guys come up with.

[born2run]

Anyone found a solution to this ?

[phranque]

Anyone found a solution to this ?

it appears at this point that your solution doesn't involve Apache in any way.
therefore i am closing this thread in the Apache Web Server forum.

if you are still looking for a solution to your GA question(s), please post this discussion in the appropriate ( Website Analytics - Tracking and Logging [webmasterworld.com]) forum for this discussion.