Definitive Guide to Removing All Google Analytics Spam

This is a PROVEN WORKING SOLUTION with filter expressions updated regularly! There are a lot of partial solutions and misinformation out there about clearing out so-called referral spam (and organic search and event spam too), so here’s the Definitive Guide to removing all of that junk! This article has been constantly updated since January 2015 and has shown over 330,000 people how to get rid of spam in Google Analytics reporting.

Language filter expression BACKSLASH DOT

Language filter expression BACKSLASH DOT

NEW: Language spam filter for
Secret.ɢ…Vote for Trump“! and
“…search shell is much better than google!” and “Google officially recommends…search shell!

This will get rid of many fake referral sources including,,,,,,,,,,,, lifehacĸ,,,

You can create a filter (image right) to stop new language spam from entering your account, and use a custom segment (image below) for historical reporting use. Read the rest of the article for the whole story and solution (for keywords like “website share buttons”).


Share on LinkedInTweet about this on TwitterShare on FacebookPin on PinterestShare on Google+Email this to someone

The Google Analytics Referral Spam Solution

The process in summary, proven effective for over 23 months:

  1. Have a new website? Use a ‘-2’ or higher property
  2. Implement a Valid Hostname Filter to eliminate ghost visits
  3. Implement Spam Crawler Filters to eliminate the targeted spam visits
  4. Create a Custom Segment with these filters to use for reporting
  5. Turn on Google’s bot & spider filter option

All the information you need is provided below in this step-by-step guide, but you will need to update the filters as they change.

Urban Myths and Bad Advice:

  • DO NOT use the Referral Exclusion List – Why?
  • Google Analytics bounce rate DOES NOT affect search rankings
  • Using .htaccess rules or WordPress plugins will NOT eliminate any of the ghost referrals

This is a long article — I have included a lot of background and detail to explain why this solution is so effective, and to dispel a number of urban myths around referral spam. Heed the advice to set up an unfiltered view before you begin — there is no recovery from a bad filter; do not risk your analytics to a typo.

Share on LinkedInTweet about this on TwitterShare on FacebookPin on PinterestShare on Google+Email this to someone

Background: The Many Faces of Referral Spam

spam-201606The problem of fake references in Google Analytics has changed significantly over the past 2 years. In 2014, we had some bots from semalt and buttons-for-website that visited your website and left fake referrals in your analytics. In December 2014, the attacks began, taking advantage of a weakness in Google’s new Measurement Protocol that allowed direct attacks on the Google Analytics tracking servers without having to actually visit your website. The attacks rotated quickly through many referral sources, leading to a lot of confusion in the industry.

Ranksonic joined in on the fun in March 2015, and they all enjoyed playing with new domains and techniques. We have had fake organic search terms ( and fake events (event-tracking) injected into our analytics, too. Enterprising individuals popped up on Fiverr offering hundreds or even thousands of visits from real webmasters obtained using these techniques.

At the beginning of 2016, there were still lots of players pushing through Google’s defenses, even if only for a few days (see image). As of June, 2016, the trend continues with most ghost spam changing in a few days, but the crawlers seem to run for months.

In late 2016, the spam has evolved again, this time focused on inserting a fake Language, and using a rotating series of fake and real sources. This latest blitz also uses valid hostnames on some of the traffic, indicating the spammer is working to get around the common protections people have deployed.

Why hasn’t Google stopped it all yet? Well, they have said they are working on it, but it is a tough fight. Trust me — it would be a LOT worse than it is if they were doing nothing. They just don’t talk about what they are doing, and that is a widely adopted security best practice: never talk about what protections you have in place. It makes it harder for the bad guys to work around your protection systems.

Share on LinkedInTweet about this on TwitterShare on FacebookPin on PinterestShare on Google+Email this to someone

BEFORE YOU BEGIN: Create an Unfiltered View

Before you start hacking away at your Google Analytics settings, the best practice for implementing new filters starts like this – create an UNFILTERED VIEW, and a TEST VIEW.


1. Make sure you always have an Unfiltered view in your property — that has absolutely no filters. This will ensure you always have the raw, unmodified data should things go wrong. There is no ‘undo’ for a bad filter.

2. Don’t create new filters directly in your main view. Create a new Test view that mirrors your main view in every other respect, and then add the filter(s) there first. Watch it for a few days and compare with the Unfiltered view to make sure it is doing what it should.

3. If you’re happy with the new filter based on this test, then go ahead and add the ‘existing filter’ to your main view.

Share on LinkedInTweet about this on TwitterShare on FacebookPin on PinterestShare on Google+Email this to someone

1. New Website? Use a ‘-2’ Property

I coined the term “ghost referral” to identify the worst offenders like darodar because they actually NEVER VISIT YOUR SITE. Using some software magic, they post fake hits to Google’s tracking service using a random series of tracking IDs. When they pick a series that includes your tracking ID, Google records a referral visit from their source in your reports, even though they know nothing about your website.

When you create a Google Analytics Account, you also create a Property in the Account, and a View in that Property. The Property gives you the tracking id (e.g. UA-1234567-1) that you use in the code snippet on your website. You can create 50 Properties in your Account, and they are given -1, -2, -3, … -50 extensions. Most ghost referral spam hits the default ‘-1’ Property, although some are now hitting -2, and -3 properties as well.

You can significantly reduce the spam simply by creating and using a second, third or fourth (or tenth) Property. You don’t have to actually use them all. Caution: changing your tracking code on your website will leave the historical data in the old property, so this is really only useful for new websites, or if you are willing to abandon your old data.


Share on LinkedInTweet about this on TwitterShare on FacebookPin on PinterestShare on Google+Email this to someone

2. Implement a Valid Hostname Filter for Ghost Visits


Some variants of these ghost visits use fake google / organic search visits with keywords for your to investigate (like “ eu cookie law“). Some are even showing up as direct visits, fake landing pages and events

Since they never actually visited your site, you can’t block their visits at the server using any website Javascript (WordPress plugins) or .htaccess methods. You have no choice but to create a filter to exclude them. The biggest problem with these ghost referrals is that they change as quickly as they appear, so you could be continuously building filters for them.

Source versus Hostname

Real visits to your website from a referral link have TWO server names available: the Source that the link is from, and the Hostname that the landing page is pointing to (your server). In most cases, the Hostname should always be your server, regardless of where the traffic came from.


For example, here is a sample of the Source and Referral Path (page with the link on it) pointing to this article. Notice the Hostname is always my server.


Ghost visits send traffic to a random series of tracking ID numbers — they don’t know your server name! They use blank (“(not set)“) or fake hostname values (like ‘’). That means you can eliminate ALL of them simply by filtering to INCLUDE only the valid hostname — your server.

A. Identify Your Valid Hostnames

STEP CAREFULLY.  Valid hostnames are websites that you have configured to use your Google Analytics tracking ID (e.g. UA-12345678-1). They may include ecommerce shopping carts or call tracking services linked from your website.

valid-hostname-identificationStart with a multi-year report showing just hostnames (Audience > Technology > Network > hostname), then identify the valid ones — the servers where you REMEMBER configuring with your tracking ID (hint: is NOT one of them).

UPDATE: if you have alternate domains that redirect to your main website domain, do NOT include those redirected domains. If you can type in one hostname/URL and it changes to display a page on a different domain, then it is NOT a valid hostname.

Many people have a problem with this step; here’s what I picked and why:

  • – my main website
  • – my help site configured with the same tracking ID
  • – I have a YouTube channel with videos that I track using Google Analytics. I had to configure my tracking code in YouTube (what a pain that was! and it only tracks channel visits, not videos). NOT RECOMMENDED for general use.
  • – I use FastSpring as my eCommerce provider to process payments. I configured it with my tracking code.

There are a number of translation and proxy services that may also record visits to your tracking ID because they display your original content through their servers. If the traffic is low, IGNORE THEM. Spammers have started using as a hostname to bypass people’s filters, so don’t add that one. Most recent example is organic search spam with keywords “beat with a shovel the weak google spots…

FYI – googleweblight is a new service from Google that servers your pages to mobile networks in some parts of the world. It usually appears with your hostname in front, and it’s ok.

I do not have any tracking codes installed on,, or any of the other sites that appear in the report. I never configured my tracking code ON those sites — they are ghost visits!

IMPORTANT: If you see GOAL CONVERSIONS or REVENUE from (not set) hostnames, you need to dig into why. Maybe they are Event-based call logging and are not associated with pageview (which has a hostname value). You may need to adjust your filters and/or tracking code snippets. 

only-my-hostnamesB. Create the Filter Expression

Create a filter expression that captures all of the domains that you consider to be valid. TEST, TEST, TEST! Then move to production when you are sure you have it all. You may find it easier to play with an Advanced Segment, so you can see the effect of your filter without risking any data loss. See #3 below.

Many people have a problem composing the filter expression because it is Regex (regular expressions), so lets keep it really simple in this case.

For your filter expression, simply enter your valid hostname. If you have more than one, separate them by a vertical bar ( | ). If you have a third-party payment service like, you may need to enter it as well.

Note: if you can’t see the “Include” radio button in the Filter page, look BELOW the Exclude section (which is expanded when it is selected). When you select Include, the Exclude section will collapse and the Include section will expand as in the image.

It is not necessary to enter all of the subdomains (like www and help) – Regex will perform a partial match by default, so I keep the expression shorter by simplifying to just the root domains.

Note: in proper Regex, you should ‘escape’ the dots (\.), but since a dot matches any character and the likelihood and impact of a false match is negligible, I sometimes leave them out to keep it simple.||

IMPORTANT: do NOT end the expression with a vertical bar ( | ); use them only between domains.

Share on LinkedInTweet about this on TwitterShare on FacebookPin on PinterestShare on Google+Email this to someone

3. Implement Spam Crawler Filters

Some spammers actually crawl the web and visit your site, and others have figured out what your hostname is, so the Valid Hostname filter won’t keep everything out. For these, you will need to specifically exclude their visits by naming them in a filter.

Note: if you are technically capable, you could block these sources using classic spam blocking techniques like using .htaccess rules. To learn a little more about these alternatives, you can read the article by Carlos Escalera.

Do NOT visit the referring site, since this is an invitation to get a virus or Trojan infection on your computer, or otherwise satisfy the desire of the spammer. I recommend you do a quick Google search first, to see if you can trust it. Spammers are quickly identified, and you’ll usually see indications in the first page of search results.

Creating a New Filter

spam-referral-filterYou can exclude them from your reports in Google Analytics by creating a filter. You identify a “unique signature” that identifies them (and only them), and then create a filter based on that.

Most spam can be eliminated by filtering on Campaign Source. Most people try filtering on Referral, and that filter doesn’t always work because some spammers have used utm codes to stuff values into the Source and Medium, imitating a referral. Note that some of the spam now requires you to filter on the Language Settings field  (Spam Crawler 5 below).


Read Google’s instructions on making filters.

The latest filter expression I recommend at at the top of this article. Note that I take some shortcuts in my expressions to save space (there is a limit to the number of characters). I have not yet found any false matches for valid referrals in any of the web properties I have worked with, but you should be cautious of being too aggressive — I have seen some people recommend filtering on simple words like buy|cheap|motor|money|seo which will simply match far too many valid domains to be recommended.

As you discover new spammers you will have to add to the filters. Remember: these filters will exclude everything that matches, so be careful with your expressions, and TEST, TEST, TEST first.

Current Spam Crawler Filter Expressions

Spam Crawlers Filter 1: [ 2015-06-01]
Custom > Exclude > Campaign Source


Spam Crawlers Filter 2: [2015-12-07]
Custom > Exclude > Campaign Source


Spam Crawlers Filter 3: [2016-06-12]
Custom > Exclude > Campaign Source||^||||^||||keywords-monitoring(-your)?|

Spam Crawlers Filter 4: [2016-11-30]
Custom > Exclude > Campaign Source|||||||||lifehacĸ


This one is DIFFERENT!

Spam Crawlers Filter 5: [2016-11-13]
Custom > Exclude > Language Settings


Filter Pattern Characters are: backslash period

Editorial note: please do not take the presence of a domain in this article to mean the related businesses are all ‘spammers’. In several cases, unsuspecting businesses have had their domains referenced by spammers e.g. or have unintentionally left referrals and since corrected their practices e.g.

Share on LinkedInTweet about this on TwitterShare on FacebookPin on PinterestShare on Google+Email this to someone

4. Create a Custom Segment

To eliminate spam immediately from all of your reports, even historical reporting, you need to use a Custom Segment. If you have prepared the filter expressions above, you’ve already done all the hard work. If you skipped to this section, go back and start at Step 1.

Start with a copy of my segment from the Google Analytics Solution Gallery [2016-11-16], and modify it to suit, or follow these instructions:

In Google Analytics, open your Reporting view, and click +Add Segment.


Then click New Segment and enter a name like “All Users (No Spam)“. If you have multiple websites in your account, you should include the website in the name, like “All Users (AnalyticsEdge)“.


Select the Advanced > Conditions tab on the left. Create a new entry for the valid hostnames:

  • Sessions > Include
  • Hostname > matches regexyour valid hostnames expression (#1 above)

Then click + Add Filter and add the expressions for the Spam Crawlers:

  • [+Add Filter]
  • Sessions > Exclude
  • Source > matches regexspam crawler expression #1    OR
  • Sessions > Exclude
  • Source > matches regexspam crawler expression #2    OR
  • repeat for the rest of the filter expressions

Save and Apply the Segment

The easiest way to test is to use your new segment in combination with the default All Users segment, comparing the Sessions counts. You can find your new segment listed in the Custom grouping. You can select BOTH your new segment AND the All Users segment to compare.

Sharing your Segment Definition With Coworkers

segment-collaborationGoogle Analytics segments are normally account-specific, but a new feature allows you to share it with other people that have access to the same Google Analytics view. When editing the segment, click the link in the upper right corner and allow Collaborators to apply/edit the segment,

Share on LinkedInTweet about this on TwitterShare on FacebookPin on PinterestShare on Google+Email this to someone

5. Turn On Google’s Bots & Spiders Option

bots-and-spidersGoogle Analytics has a simple checkbox you can use to exclude easy-to-identify bots and spiders, but you have to enable it for every View you use. In your Google Analytics Admin section, navigate to each View you use, select View Settings, and check the box to Exclude all hits from known bots and spiders.

This feature has recently started affecting referral spam as well (e.g. / referral), so TURN IT ON!



That’s It – You Are Spam-Free For Now!

Share on LinkedInTweet about this on TwitterShare on FacebookPin on PinterestShare on Google+Email this to someone

What made me an expert about spam?

My name is Mike Sullivan; I am a Google Analytics Certified professional, and a Top Contributor in the Google Analytics community forum. I have been working extensively with the Google Analytics API since 2010, providing customized reporting solutions. I founded Analytics Edge in 2013, making a suite of free and inexpensive Excel report automation add-ins and connectors.

Spam was hounding my customers, so I dug into the problem with all the tools at my disposal and thought I’d share what I learned. I wrote this Definitive Guide, coining the term “ghost referrals”, to help resolve the confusion surrounding the various spam types and the different techniques required to deal with them.  I hope this article has helped you, too.

Top spammers past 30 days (2016-11-30)


Secret.ɢ You are invited! Enter only with this ticket URL. Copy it. Vote for Trump!



share buttons
website buttons
social share buttons
social media share buttons
social sharing buttons
share this button
social media sharing buttons
social share button
linked in share button
html share buttons
share buttons html
vk share button
sharing buttons
share buttons for website
social media share button
add this share button
email share button
addthis share button
reddit share button
sharing button
like share button
add share buttons to website
youtube share button
…and more…




MOST ANNOYING: / referral / referral…
analytics secret.ɢ you are invited! enter only with this ticket url. copy it. vote for trump!
beat with a shovel the weak google spots…
ecret.ɢ you are invited! enter only with this ticket url. copy it. vote for trump! eu cookie law
floating share buttons
google analytics language spam
google analytics secret.ɢ you are invited! enter only with this ticket url. copy it. vote for trump!
google analytics vote for trump
language: secret.ɢ you are invited! enter only with this ticket url. copy it. vote for trump!
linked in share button
reddit share button
referral spam google analytics
secret.ɢ you are invited! enter only with this ticket url. copy it. vote for trump
share button code
share button generator
share button html
share buttons for website
share buttons
share buttons
share this button share buttons google analytics
sharing buttons
social media share buttons
social share button
spam google analytics / referral
vk share button
website buttons
you are invited! enter only with this ticket url. copy it. vote for trump!
youtube share button

Historical list of spam sources detected

  • 2016-12-09 / referral ghost spam
  • 2016-12-09 “Google officially recommends search shell!”  / language spam may have valid hostname, valid or fake referral sources
  • 2016-12-05 “ search shell is much better than google!”  / language spam may have valid hostname, valid or fake referral sources
  • 2016-11-30 / referral SPAM CRAWLER
  • 2016-11-30 lifehacĸ / referral SPAM CRAWLER
  • 2016-11-29 / referral ghost spam
  • 2016-11-06 “Secret.ɢ You are invited! Enter only with this ticket URL. Copy it. Vote for Trump!” / language spam may have valid hostname, valid or fake referral sources
  • 2016-10-26 / landing page spam
  • 2016-10-26 / landing page spam
  • 2016-10-26 various keyword combinations of with social, share, buttons, website, this, html, linked, in, add, and other words
  • 2016-10-25 / referral SPAM CRAWLER
  • 2016-10-24 24× / referral ghost spam
  • 2016-10-12 “cdn” organic keyword ghost spam
  • 2016-10-11,,,,,, / referral ghost spam
  • 2016-10-02 – / referral SPAM CRAWLER
  • 2016-09-24 – / referral ghost spam
  • 2016-09-10 –,,,,,,,,,,,,,,,,,,,,,,,,,, scanner-walt, scanner-walter, / referral ghost spam
  • 2016-08-30 –,,,,,,,,,,,,,,,,,,,,,,,,, / referral ghost spam
  • 2016-08-27 – / referral ghost spam
  • 2016-08-23 – / referral ghost spam
  • 2016-08-22 – / referral ghost spam
  • 2016-08-18 –,,, / referral ghost spam
  • 2016-08-18 – / referral SPAM CRAWLER
  • 2016-08-18 – / referral SPAM CRAWLER
  • 2016-08-12 – / referral SPAM CRAWLER
  • 2016-08-12 –,,, / referral ghost spam
  • 2016-08-09 –,, / referral ghost spam
  • 2016-08-03 – / referral ghost spam
  • 2016-08-02 – / referral SPAM CRAWLER
  • 2016-08-02 – / referral ghost spam
  • 2016-07-30 – / referral ghost spam
  • 2016-07-30 – / referral ghost spam
  • 2016-07-28 – / referral ghost spam
  • 2016-07-27 – / referral ghost spam
  • 2016-07-26 – / referral ghost spam
  • 2016-07-25 – / referral ghost spam
  • 2016-07-21 – / referral ghost spam
  • 2016-07-21 –,,,,,,,, / referral ghost spam
  • 2016-07-21 –,,,,,,,,, referral ghost spam
  • 2016-07-20 – / referral ghost spam
  • 2016-07-20 – / referral ghost spam
  • 2016-07-18 – / referral ghost spam
  • 2016-07-17 – / referral ghost spam
  • 2016-07-16 – / referral ghost spam
  • 2016-07-16 – “ …” organic keyword ghost spam
  • 2016-07-15 – / referral ghost spam
  • 2016-07-13 – / referral ghost spam
  • 2016-07-11 – / referral SPAM CRAWLER
  • 2016-07-08 – / referral ghost spam
  • 2016-07-08 – eu-cookie-law.blogspot.* / referral ghost spam
  • 2016-07-08 – free-share-buttons.blogspot.* / referral ghost spam
  • 2016-07-04 –,,,,,,,,, / referral ghost spam
  • 2016-07-01 – free-share-buttons-???.xyz / referral ghost spam
  • 2016-06-27 – / referral ghost spam
  • 2016-06-19 – / referral ghost spam
  • 2016-06-19 – law-enforcement-check-*.xyz / referral ghost spam
  • 2016-06-19 – free-social-buttons-???.xyz / referral ghost spam
  • 2016-06-17 – / referral ghost spam
  • 2016-06-16 – organic keywords ghost spam
  • 2016-06-11 – law-enforcement-bot-??.xyz / referral ghost
  • 2016-06-08 – social-buttons-??.xyz / referral ghost spam
  • 2016-06-04 – law-enforcement-??.xyz / referral ghost spam
  • 2016-06-04 – / referral SPAM CRAWLER
  • 2016-05-31 – / referral ghost spam
  • 2016-05-31 – / referral ghost spam
  • 2016-05-31 – / referral ghost spam
  • 2016-05-29 – / referral ghost spam
  • 2016-05-28 – / referral ghost spam
  • 2016-05-28 – / referral ghost spam
  • 2016-05-28 – / referral ghost spam
  • 2016-05-27 – / referral ghost spam
  • 2016-05-27 – cookie-law-enforcement-??.xyz / referral ghost spam
  • 2016-05-27 – / referral ghost spam
  • 2016-05-27 – / referral ghost spam
  • 2016-05-27 – / referral SPAM CRAWLER
  • 2016-05-27 – / referral ghost spam
  • 2016-05-27 – / referral
  • 2016-05-25 – organic keywords ghost spam
  • 2016-06-23 – / referral ghost spam
  • 2016-05-20 – / referral spam crawler
  • 2016-05-20 – / referral ghost spam
  • 2016-05-18 – / referral ghost spam
  • 2016-05-16 – / referral ghost spam
  • 2016-05-08 / referral ghost spam
  • 2016-05-05 / referral ghost spam
  • 2016-05-04 / referral ghost spam
  • 2016-04-30 / referral ghost spam
  • 2016-04-28 / referral ghost spam
  • 2016-04-26 / referral ghost spam
  • 2016-04-25 ‘i came up with a method and 1,5 years forcing…’ ghost organic keywords
  • 2016-04-25 lots of other ghost organic keywords, including,,, and others
  • 2016-04-25 / referral ghost spam
  • 2016-04-18 / referral ghost spam
  • 2016-04-18 / referral ghost spam (# is 2, 3, 6, 7, etc)
  • 2016-04-17 and / referral ghost spam
  • 2016-04-14 / referral crawler
  • 2016-04-11 / referral ghost spam
  • 2016-04-10 and / referral ghost spam
    2016-04-09 / referral spam crawler added to filter expressions
  • 2016-04-08 / referral ghost spam
  • 2016-04-01 /referral and яндех-херня.рф / referral ghost spam
  • 2016-03-23 / referral and / referral added to spam crawler filters
  • 2016-03-23 / referral ghost spam
  • 2016-03-21 referral ghost spam
  • 2016-03-18 /referral ghost spam
  • 2016-03-15 / referral ghost spam
  • 2016-03-10 / referral spam crawler
  • 2016-03-05 / referral spam crawler
  • 2016-03-03 / organic search from hostname ghost spam
  • 2016-03-03 / referral spam crawler
  • 2016-02-28  / referral ghost spam  / referral ghost spam  / referral ghost spam  / referral ghost spam  / referral ghost spam  / referral ghost spam  / referral ghost spam  / referral ghost spam  / referral ghost spam
  • 2016-02-27  / referral ghost spam
  • 2016-02-16 / referral ghost spam
  • 2016-02-10 китай.с.новым.годом.рф / referral ghost spam
  • 2016-01-26 / referral ghost spam
  • 2016-01-22 / referral ghost spam (
  • 2016-01-22 / referral ghost spam (
  • 2016-01-20 / referral ghost spam (
  • 2016-01-20 / referral ghost spam (
  • 2016-01-20 / referral ghost spam (
  • 2016-01-20 / referral ghost spam (
  • 2016-01-13 / referral spam crawlers
  • 2016-01-03 / referral ghost spam (
  • 2016-01-01 с.новым.годом.рф / referral (ilovevitaly) ghost spam
  • 2015-12-31 / referral (ilovevitaly) ghost spam
  • 2015-12-29 / referral ghost spam (
  • 2015-12-25 referral ghost spam  ( /
  • / referral ghost spam (
  • / referral ghost spam (
  • / referral ghost spam
  • / referral spam crawlers
  • / referral spam crawlers
  • / referral ghost spam (
  • referral ghost spam (
  • / referral ghost spam (
  • / referral ghost spam (
  • 2015-12-22 / referral ghost spam
  • 2015-12-21  / referral ghost spam
  • 2015-12-20 / referral ghost spam
  • 2015-12-19 / referral ghost spam
  • 2015-12-14 ^ /referral added to spam crawlers filters
  • 2015-12-09 / referral (ilovevitaly) ghost spam
  • 2015-12-08 / referral ( ghost spam
  • 2015-12-08 / referral ( added to spam crawler filters
  • 2015-12-04 / referral ghost spam
  • 2015-12-04 / referral ghost spam
  • 2015-12-02 / referral ghost spam
  • 2015-12-01 / referral ghost spam
  • 2015-11-27 /referral ghost spam
  • 2015-11-27 / referral ( added to spam crawler filters
  • 2015-11-27 / referral ( ghost spam
  • 2015-11-27 / referral ghost spam
  • 2015-11-26 / referral ghost spam
  • 2015-11-26 / referral ghost spam
  • 2015-11-24 / referral ghost spam
  • 2015-11-23 / referral ( ghost spam
  • 2015-11-20 / referral added to spam crawler filters
  • 2015-11-19 / referral ( ghost spam
  • 2015-11-18 / referral ghost spam
  • 2015-11-18 / referral ( ghost spam
  • 2015-11-17 / referral ( ghost spam
  • 2015-11-16 /referral ghost spam
  • 2015-11-16 / referral ( ghost spam
  • 2015-11-16 / referral spam crawler
  • 2015-11-16 / referral spam crawler
  • 2015-10-08 /referral spam crawler
  • 2015-10-04: / referral spam crawler
  • 2015-09-21: / referral ghost spam
  • 2015-09-21: / referral: some spammers don’t know what they are doing
  • 2015-09-16: / referral ghost spam
  • 2015-09-15: added to spam crawler filters
  • 2015-09-01: which redirects to
  • 2015-09-01: which redirects to
  • 2015-08-26: ghost spam is free from the politics, we dancing like a paralytics / organic keywords
  • 2015-08-15: / referral
  • 2015-08-13: / referral**
  • 2015-08-13: / referral
  • 2015-08-09: / referral
  • 2015-08-09: / referral
  • 2015-08-05: / referral
  • 2015-08-05: / referral
  • 2015-07-29: / referral
  • 2015-07-24: / referral
  • 2015-07-20: / referral
  • 2015-07-02 / referral
  • 2015-06-26 / referral
  • 2015-06-18 / referral
  • 2015-06-09 / referral and organic
  • 2015-06-04 / referral
  • 2015-06-03 непереводимая.рф / referral
  • 2015-06-01 непереводимая.рф / organic
  • 2015-05-29 / organic
  • 2015-05-27 / referral
  • 2015-05-26 / referral
  • 2015-05-21 / organic
  • 2015-05-19 / organic
  • 2015-05-15 / referral and / referral and / referral
  • 2015-05-06 / referral, / referral, / referral and some spikes of direct traffic (direct) / (none).
  • 2015-04-28 (google / organic) search spam with keyword “vitaly rules google…”
  • 2015-04-24 ( / referral, / referral, / referral, / referral, / referral, / referral, / referral, / referral, / referral)
  • 2015-04-06 ( / referral) and ( / referral) and
  • 2015-04-02 / referral
  • 2015-03-26 / referral
  • 2015-02-23 / referral
  • 2015-03-16 / referral and
  • 2015-03-11
  • 2015-03-04 / referral
  • 2015-02-25: / referral
  • 2015-02-11:
  • 2015-02-04: / referral
  • 2015-01-27: / referral
  • 2015-01-19:  “google officially -recommends search shell” and “resellerclub scam” organic
  • 2015-01-15: “ / referral
  • …and more…

Comments: (moderated, no spam)

  1. vera...obmana

    i can see that for these fake refferals, like,, lifehacĸ, the “network domain” is

    is there a way to filter our “network domain”? i tried but it was not in the selection for exclude filter

    1. mike_sullivan

      I do not recommend filtering by domain if the domain is a generic ISP such as (that’s a hint…ISP domain). Also, the spammer uses a lot of other ISPs, so the filter is of limited use.

  2. Shailendra Dubey

    Hi Mike,

    Thanks for sharing useful article.

    My problem is that i am getting spam referrals with valid host-name. Below is the sample of the report

    Referral Path Hostname

    How can i handle this?

    1. mike_sullivan

      Yes, the latest spam attacks have used valid hostnames for some websites. The lifehacker (with a weird ‘k’) would be blocked by the Spam Crawlers 4 expression – use that in your segment.

  3. Irene

    Hi everyone!

    This article is great, I implemented all the filters and I block all the spam for now, thank you very much.

    I only have a doubt. Although I don’t see the spam referral sources anymore in GA Acquisition, I still can see them in Real Time. Is that normal? Maybe I made some mistake implementing the filters? I talk specifically about

    Thank you in advance!

    1. mike_sullivan

      Yes, it is normal to see some spam in the real time views but not in the main reports. That is your filters (and Google’s) at work.

  4. Ady Jo

    I’ve been trying to filter several Ghsot Referral sites, but the same ‘…would not have changed your data.’ message appears when filter is verified. I’ve tried putting the tunnel-bar, even include a backslash before each period/dot. Any suggestions where te edit to make filter verifiable?

    Here’re the list of our site’s ghosts:[…]

    I’d appreciate any insights on this, thanks.

    1. mike_sullivan

      I do not comment on individual filter expressions since it is too easy to overlook a space or extra character in the wrong place – I publish a set that I know works. The filter verification feature often does not work – try your filter in a test view first.

  5. TrendyInners

    My analytics account got effected by spammers. It is very useful but i have 50 hostnames how can i find the spam hostname.

    1. mike_sullivan

      Re-read the section on valid hostnames — most people have 1 valid hostname, so the other 49 would be fake hostnames used by the spammer. Your valid hostname appears in the browser address bar when you visit your website. My website is NOT, so that is NOT a valid hostname for my analytics.

  6. Lars

    Hi Mike,

    I am a beginner in the industry so excuse me if this question seems very basic.

    In the beginning of this post you say that there is no ‘undo’ button for a filter. What do you mean by this?

    In my GA account, next to every filter it says “delete”. Did they recently change it or is there something else I’m missing here?

    1. mike_sullivan

      Once data in your view is processed for the day, there is no changing it. If you create a filter that removes too much data, and don’t fix it (or delete it) for a couple of days, all that data is lost forever — it cannot be ‘undone’ for those days. Google Analytics will not go back and reprocess the data for the past.

    1. mike_sullivan

      Language Settings is the Language field in your reports. My use of the expression \. means anything with a period in it, which covers all web addresses. The dot character is a special character in Regex, so it needs to be ‘escaped’ with a \ in front of it: \.

      1. Jason Bouwmeester

        Appreciate the quick response Mike. And I understand the use of the \. – just not sure how the Language Settings would have a web address in it, or how this only filters out the fake traffic based on Unicode characters in the URL.

      2. mike_sullivan

        Check your Audience > Geo > Language report….. “Secret.ɢ You are invited! Enter only with this ticket URL. Copy it. Vote for Trump!” is showing up as a language for many fake referrals. If you filter on the dot, it doesn’t matter that the ‘G’ is a Unicode character.

      3. Donna Duncan

        Mike, Are we supposed to add the language settings exclusion to the new reporting segment as well? If yes, would we choose

        add filter
        language contains

      4. mike_sullivan

        No…Be careful with the Segment expression…

        With a Custom Filter, the expressions are always “Regular Expressions” or Regex. In Regex, the dot character is a special character and must be ‘escaped’ by preceding it with a backslash (\.).

        With a Custom Segment, you can choose between “contains” or “matches regex”. If using “contains” the expression is a simple dot (.), but if using “matches regex” the expression needs to be escaped (\.).

  7. raaahlouf

    hi, how can you be aware of all theses thinks and details?? How can you be informed of so many things on the subject? It’s still strange …. it’s to wonder if you are not a link in the chain!

    1. mike_sullivan

      I am surpised no one else has voiced that concern yet. I know the things I do because of the business I run — I sell products that download data direct from Google Analytics and other sources for people to build custom reports in Microsoft Excel. My customers saw the spam way back in December 2014 and I could tell that it was different from previous referral spam. With the API, you can download 7 dimensions at the same time, so it is easy for me to see Source/Medium, Hostname, City, Country, Browser, Operating System, Language all in one report, and that makes it easy to identify a unique combination of traffic that ‘spikes’ when these fake referrals appear.

      Since that time, I created my own tracking programs that scan for new sources of traffic daily. I started offering a service to my customers to manage filters for them, and now I scan hundreds of their sites on a daily basis, looking for common traffic amongst them [I build analysis tools for a living]. Because I offer a service to keep my customers spam free, I have to review the data every day and respond to any new threat. I share what I see with everyone through my articles and social media because my spam filtering service is a side business for me.

  8. Luigi Riccobono

    Very great article! Mike Thanks for your job. I will post in my blog a direct link to this page to share your precious and helpful work!

  9. corrie

    in including those hostnames, did you created another view that includes hostnames? or just created a filter under the test view? I am testing your steps now, and we have a test view for creating changes. thanks for a very insightful article!

    1. mike_sullivan

      The valid hostname filter is created in the Test view along with the other spam filters, and after confirmation, applied to your main reporting view.

  10. Debbie K

    Upvoted in Analytics Gallery and suggest that others do the same! Best way to thank Mike for his free solution!

  11. Debbie K

    So useful can’t thank you enough for sharing this. I’ve been helping a friend out with a big site and seeing referral spam faking landing pages, bounce, time on page, where the source looks legit, referral path looks legit and you just have to dig until you find it. And it’s only because we’re running an experiment where we are examining every URL all 5,000 that I’m seeing some of this surface and found your site as I had spam filters in place already, just didn’t realise how deep or sneaky they’ve become. I don’t do any paid ads but won’t this affect the impressions in adwords if you’re bidding by CPM?

    1. mike_sullivan

      The ghost spam in Google Analytics would have no impact to Google AdWords functionality, since it actually does not exist. AdWords tracks clicks by a different method that Analytics tracks sessions.

  12. Roman

    Thanks a lot for your help Mike! Very Professional ,knowledgeable and super responsive. Highly recommended for the less experienced or less tech savvy business owners.

  13. Rachel

    My website is less than a week old. I applied all of your filters and literally all sessions disappeared, including the ones referring from Facebook. Did I do something wrong? Is it possible that it’s all spam this early on? A little disappointed, but I’m glad to have it filtered out for future reports. Thanks for the straightforward guide. I have attempted to use others only to feel annoyed and confused.

    1. mike_sullivan

      The most common mistake that causes all data to disappear is getting the valid hostname filter wrong. Start by trying the expression in a segment – you can play all you want, not have to wait to see the results, and not affect any of the underlying data.

  14. Mike M.

    Hi Mike,

    What’s the benefit to creating the multiple views and filters (include and exclude) in the Admin tab if you can simply add them in your custom Segments? Seems like the effect is the same (filtered data) and you can experiment with and compare the filtered results without losing any data. Am I missing something?


    1. mike_sullivan

      You are right — using a segment is an easy alternative solution. The problem is that you need to remember to apply the segment in every report you look at, and the tool (website/app) will likely not remember your settings. Another problem is that, if your website have more than 250000 sessions in the reporting period, a segment will often suffer from sampling errors — especially bad when you start drilling down into the details.

  15. Connie

    I was looking at your “Only my hostnames” image example and in your Filter pattern there is no “\” before the .com and I got a little confused (doesn’t take much).

  16. Connie

    First I want to thank you for all your hard work! I just want to clarify something for myself. When doing and “Exclude” filter > Campaign Source > the Filter Pattern DOES NOT need the “\” before the periods, but when doing the “Include” >Hostname filter you DO need the “\” before the periods, is that correct?

    1. mike_sullivan

      In regular expressions, the period means ‘any character’. Putting a backslash in front of it means ‘only a period’. If you are trying to be exacting, you should include the backslash. In many cases it does not really matter, since a hostname that includes ‘’ is not a random hostname, even if the period is some other character. Whether you include the backslash depends on how precise you want to be. In the hostname filter, you can be more relaxed because the impact is you let a little more through. With the exclude filters, avoid expressions that are too general.

  17. Todd

    I’ve created a segment of ‘bot’ traffic which shows that between 20-50% of traffic on my clients websites is from bot traffic.;

    User type – New user
    Bounces – 1
    Session duration – <1

    Am I right to think that this traffic is bot traffic?

    I've looked at the usual dimensions (hostname, service providers, browser versions, screen resolution etc) in order to isolate the issue but I'm still getting huge amounts of bot traffic. It's not just direct or referral but appears to be equal across all channels.

    Is there anything you can suggest to exclude it?

      1. Todd

        Thanks Mike! That completely slipped my mind. I’m glad I didn’t message any clients about their BOT problem then. That could have been embarrassing!! Thanks for the save

  18. Harsh

    Thanks for the great tutorial to remove spam from analytics. I was able to get rid of it in my account by following this tutorial.

  19. Pullkit Gera

    I visited this page a year ago and I’m glad to see it has been kept updated. Thanks for helping us keep our Google Analytics spam free :)

    I will include a backlink to this page from my blog in the coming few months.

    Thanks :)

  20. Chris

    I don’t mean to be redundant but echo what John wrote last month. The Guide truly is definitive and the amount of information stuffed into your guide is amazing. I too hope those who can benefit from having “a professional do it for you” do so in droves. You deserve every penny. Job well done falls so short of how well you actually did!


Leave a Reply

Your email address will not be published. Required fields are marked *