{"id":30,"date":"2019-07-04T19:59:54","date_gmt":"2019-07-04T18:59:54","guid":{"rendered":"https:\/\/organicdigital.co\/blog\/?p=30"},"modified":"2024-06-10T14:30:01","modified_gmt":"2024-06-10T13:30:01","slug":"how-to-block-google-analytics-spam-from-ashburn-and-chicago","status":"publish","type":"post","link":"https:\/\/daveashworth.co\/blog\/how-to-block-google-analytics-spam-from-ashburn-and-chicago\/","title":{"rendered":"How To: Block Google Analytics Spam from Ashburn and Chicago"},"content":{"rendered":"\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_85 counter-hierarchy ez-toc-counter ez-toc-grey ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"Toggle Table of Content\"><span class=\"ez-toc-js-icon-con\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #999;color:#999\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #999;color:#999\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/daveashworth.co\/blog\/how-to-block-google-analytics-spam-from-ashburn-and-chicago\/#The_Story_Behind_This_Case_Study\" >The Story Behind This Case Study<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/daveashworth.co\/blog\/how-to-block-google-analytics-spam-from-ashburn-and-chicago\/#How_Do_You_Identify_Analytics_Spam\" >How Do You Identify Analytics Spam?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/daveashworth.co\/blog\/how-to-block-google-analytics-spam-from-ashburn-and-chicago\/#How_Do_You_Set_Up_Filters_For_Multiple_Cities\" >How Do You Set Up Filters For Multiple Cities?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/daveashworth.co\/blog\/how-to-block-google-analytics-spam-from-ashburn-and-chicago\/#What_If_There_Is_Genuine_Traffic_From_Ashburn_or_Chicago\" >What If There Is Genuine Traffic From Ashburn or Chicago?<\/a><\/li><\/ul><\/nav><\/div>\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"The_Story_Behind_This_Case_Study\"><\/span>The Story Behind This Case Study<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A client recently saw a spike in direct traffic that didn\u2019t quite stack up.  As a <a href=\"https:\/\/daveashworth.co\/skills\/analytics-and-ad-tracking-consultant\/google-analytics-4\/\">Google Analytics consultant<\/a> I see this a lot.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" width=\"546\" height=\"422\" src=\"https:\/\/daveashworth.co\/blog\/wp-content\/uploads\/2019\/07\/direct-traffic.png\" alt=\"Direct Traffic\" class=\"wp-image-32\" srcset=\"https:\/\/daveashworth.co\/blog\/wp-content\/uploads\/2019\/07\/direct-traffic.png 546w, https:\/\/daveashworth.co\/blog\/wp-content\/uploads\/2019\/07\/direct-traffic-150x116.png 150w, https:\/\/daveashworth.co\/blog\/wp-content\/uploads\/2019\/07\/direct-traffic-300x232.png 300w\" sizes=\"(max-width: 546px) 100vw, 546px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">This seemed odd as there hadn\u2019t been any sort of marketing,\nonline or offline, that would have led to this uplift \u2013 looking into this further,\nI could see that this traffic had extremely low engagement:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" width=\"592\" height=\"163\" src=\"https:\/\/daveashworth.co\/blog\/wp-content\/uploads\/2019\/07\/ga-data.png\" alt=\"GA Data\" class=\"wp-image-33\" srcset=\"https:\/\/daveashworth.co\/blog\/wp-content\/uploads\/2019\/07\/ga-data.png 592w, https:\/\/daveashworth.co\/blog\/wp-content\/uploads\/2019\/07\/ga-data-150x41.png 150w, https:\/\/daveashworth.co\/blog\/wp-content\/uploads\/2019\/07\/ga-data-300x83.png 300w\" sizes=\"(max-width: 592px) 100vw, 592px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">When the bounce rate is so high and duration so low, you can be pretty sure this is <a href=\"https:\/\/daveashworth.co\/skills\/analytics-and-ad-tracking-consultant\/google-analytics-4\/\">Google Analytics<\/a> spam via a spambot of some sort.&nbsp; Whilst Google is generally good at blocking spambot traffic, in the never-ending war against spam some will inevitably slip through the net.&nbsp;&nbsp; <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">So, the next step is to determine where this is coming from and filter this from your view so as not to skew your data moving forward \u2013 unfortunately, it won\u2019t remove the data retrospectively, but you can use a segment if you want a view of historical data with spam removed.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"How_Do_You_Identify_Analytics_Spam\"><\/span><strong>How Do You Identify Analytics Spam?<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">By reviewing various dimensions, it should be possible to identify\na common denominator for GA spam \u2013 most often you will find it comes from a\nhostname other than your domain, or a language type that you wouldn\u2019t normally\nexpect to see.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In this case, we identified the source as a city called Ashburn\nin the USA.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" width=\"1024\" height=\"277\" src=\"https:\/\/daveashworth.co\/blog\/wp-content\/uploads\/2019\/07\/city-data-1024x277.png\" alt=\"City Data\" class=\"wp-image-34\" srcset=\"https:\/\/daveashworth.co\/blog\/wp-content\/uploads\/2019\/07\/city-data-1024x277.png 1024w, https:\/\/daveashworth.co\/blog\/wp-content\/uploads\/2019\/07\/city-data-150x41.png 150w, https:\/\/daveashworth.co\/blog\/wp-content\/uploads\/2019\/07\/city-data-300x81.png 300w, https:\/\/daveashworth.co\/blog\/wp-content\/uploads\/2019\/07\/city-data-768x208.png 768w, https:\/\/daveashworth.co\/blog\/wp-content\/uploads\/2019\/07\/city-data.png 1038w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Ashburn, as it happens, is home to a number of big tech companies\nin the US \u2013 one of them being an Amazon Datacenter \u2013 which means in turn it\nwill host a number of spambots.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">As the client is a tech company based in the US, we had to be\nsure this traffic wasn\u2019t genuine, but as you can see from the screengrab above,\nthe engagement is low enough for us to decide that traffic from this city should\nbe blocked.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To do this, you set up a Google Analytics Filter which\nblocks any traffic from a city as follows:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" width=\"319\" height=\"317\" src=\"https:\/\/daveashworth.co\/blog\/wp-content\/uploads\/2019\/07\/filter-1.png\" alt=\"Filter\" class=\"wp-image-35\" srcset=\"https:\/\/daveashworth.co\/blog\/wp-content\/uploads\/2019\/07\/filter-1.png 319w, https:\/\/daveashworth.co\/blog\/wp-content\/uploads\/2019\/07\/filter-1-300x298.png 300w, https:\/\/daveashworth.co\/blog\/wp-content\/uploads\/2019\/07\/filter-1-150x150.png 150w\" sizes=\"(max-width: 319px) 100vw, 319px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Further to this, another UK based client saw a spike in\ntraffic from Chicago which again had low engagement \u2013 so again a filter was set\nup as above.&nbsp; However, as it would seem\nthat city-based spam is on the rise, you don\u2019t really want to have to set up a segment\nfor each city that is causing issues.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"How_Do_You_Set_Up_Filters_For_Multiple_Cities\"><\/span><strong>How Do You Set Up Filters For Multiple Cities?<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">To do this, you simply list all the offending locations separated\nby a pipe symbol which effectively says \u201cor\u201d, for example:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ashburn|Chicago<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"What_If_There_Is_Genuine_Traffic_From_Ashburn_or_Chicago\"><\/span><strong>What If There Is Genuine Traffic From Ashburn or Chicago?<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If your site is not US based and generally doesn\u2019t serve US visitors,\nchances are the above filter will resolve your issues.&nbsp; However, if you get genuine traffic from these\nlocations, you don\u2019t want to do a city-based filter and block real life visitors.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In this case, you should go the relevant section in Google Analytics\n\u2013 in this case Audience -&gt; Geo -&gt; Location, click on to the city sending\nthe spam, then add in a secondary dimension of \u201cNetwork Domain\u201d \u2013 this basically\nis a look up of the user\u2019s IP to determine their ISP.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">From this, you should be able to identify the source of your\nspam:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" width=\"584\" height=\"474\" src=\"https:\/\/daveashworth.co\/blog\/wp-content\/uploads\/2019\/07\/chicago-data.png\" alt=\"City Geo Data\" class=\"wp-image-36\" srcset=\"https:\/\/daveashworth.co\/blog\/wp-content\/uploads\/2019\/07\/chicago-data.png 584w, https:\/\/daveashworth.co\/blog\/wp-content\/uploads\/2019\/07\/chicago-data-150x122.png 150w, https:\/\/daveashworth.co\/blog\/wp-content\/uploads\/2019\/07\/chicago-data-300x243.png 300w\" sizes=\"(max-width: 584px) 100vw, 584px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">In the above example, we identified the top two networks \u2013 \u201cunknown.unknown\u201d\nand \u201crelatively.com\u201d as the culprits sending high volumes of visits with\nsession durations averaging at a second or less.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In this case, you can create a filter that blocks by \u201cISP\nDomain\u201d \u2013 as these contain full stops, you should place a backslash before each\nso the filter is as follows:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" width=\"319\" height=\"379\" src=\"https:\/\/daveashworth.co\/blog\/wp-content\/uploads\/2019\/07\/network-filter.png\" alt=\"ISP Filter\" class=\"wp-image-37\" srcset=\"https:\/\/daveashworth.co\/blog\/wp-content\/uploads\/2019\/07\/network-filter.png 319w, https:\/\/daveashworth.co\/blog\/wp-content\/uploads\/2019\/07\/network-filter-126x150.png 126w, https:\/\/daveashworth.co\/blog\/wp-content\/uploads\/2019\/07\/network-filter-253x300.png 253w\" sizes=\"(max-width: 319px) 100vw, 319px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Of course, you may now run the risk of blocking genuine traffic from other sources, so be sure to check if any other traffic is coming in off any networks you wish to block.<br><br>If you do find that the spam is coming from a genuine network, look for any other potentially spammy dimensions such as language or hostname.  Generally, you tend to find something with spam that you can filter and block.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ideally you would want to create a filter that excludes multiple dimensions &#8211; e.g. City + ISP, however, that\u2019s not possible in analytics, which is a bit of a shame really.&nbsp; And you can be certain that the spammers know this and hence make it as difficult as they can for you to block them.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">And so the war against spam goes on.  Hopefully the above solution will help you win this particular battle.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>You may have seen a spike in traffic with low engagement in Google Analytics which is probably spam.  Find out how to spot it, and how to block it.<\/p>\n","protected":false},"author":1,"featured_media":31,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[15],"tags":[],"class_list":["post-30","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-analytics"],"_links":{"self":[{"href":"https:\/\/daveashworth.co\/blog\/wp-json\/wp\/v2\/posts\/30","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/daveashworth.co\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/daveashworth.co\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/daveashworth.co\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/daveashworth.co\/blog\/wp-json\/wp\/v2\/comments?post=30"}],"version-history":[{"count":0,"href":"https:\/\/daveashworth.co\/blog\/wp-json\/wp\/v2\/posts\/30\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/daveashworth.co\/blog\/wp-json\/wp\/v2\/media\/31"}],"wp:attachment":[{"href":"https:\/\/daveashworth.co\/blog\/wp-json\/wp\/v2\/media?parent=30"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/daveashworth.co\/blog\/wp-json\/wp\/v2\/categories?post=30"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/daveashworth.co\/blog\/wp-json\/wp\/v2\/tags?post=30"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}