Fake Hits or Invalid Traffic to your Website
Fake hits or invalid traffic to a website manipulate Google Analytics to suit the purposes of anyone who has a financial interest in doing so.
In a recent post I wrote about a site audit carried out on a website that simply wasn’t performing for the owners.
The site was developed for a small business in Brisbane and the phones weren’t ringing; the contact form wasn’t producing enquiries; and friends and family of the owners couldn’t easily find the site in Google searches.
When the owners approached the developers, they were assured that everything was working well. In fact, a report of “SEO Results” was forwarded to prove that significant traffic was being generated to the site.
This image from the report (shown here with the developers’ logo removed) was presented as the summary of web site visits for one month – the month of July, 2021. Initially, it looked very impressive …over 9,500 visitors and more than 25,000 pageviews. And yet the phones still weren’t ringing and there were zero enquiries from those 9,500 visitors.
Before I read the rest of the report, one figure from this table grabbed my attention …0.7% bounce rate. That indicates that less than one percent of those 9,500 visitors left the site without visiting at least one more page. That is, almost no one was “bouncing” away from this site.
That figure is totally unrealistic and indicates that there was something very “fishy” about this report of “SEO Results” drawn from Google Analytics.
Bounce rate is calculated when someone visits a single page on your website and does nothing on the page before leaving. More specifically, a website’s bounce rate measures how many visitors leave a page without performing a specific action, such as buying something, filling out a form, or clicking on a link.
definition of bounce rate taken from SEMRush
Bounce Rate
Bounce rate is one of the parameters in an analytics report that is only ever studied if there is a reason to do so. In the audit of this site, there definitely was a reason to study it because something about the reported traffic to the site coupled with an extraordinarily low bounce rate seemed totally inconsistent with the actual performance of the site.
Andy Crestodina (Co-Founder / Chief Marketing Officer of Orbit Media) discussed bounce rate in a blog in which he analysed the Google Analytics of 501 business websites built by his company, Orbit Media. He discovered that the average bounce rate of professionally built business websites was 61%.
(Andy gives a good introduction to the whole subject in the YouTube video included within the blog page mentioned above).
The blog went on to study variations across traffic sources, types of websites, and industry sectors. The average bounce rate didn’t vary much …it generally remained between 55% and 65%.
This was all starting to indicate that there was very definitely something “out of the ordinary” happening on this site.
Too much uniformity
When real humans visit websites, there will be a great deal of variation reflected in any analytics derived from those visits. The visitors will come from different locations, using different devices, at different times …and their differing interest levels in the content presented on a site will mean that they will visit different pages for different amounts of time.
This “randomness” is called “entropy” and is used by some sophisticated website analytics software to detect activity derived from bots rather than human visitors.
The site audit of this site led me to the work of Dr Augustine Fou who has investigated digital advertising fraud for more than 25 years. Dr Fou has developed his own suite of tools for measuring website analytics and this will be discussed further below.
A deeper look at some of the analytics from this site highlights a distinct lack of entropy. It soon became very clear that the vast majority to traffic measured on this site was IVT (invalid traffic) …traffic generated by bots rather than humans. This was due to that fact that there was simply too much uniformity in the analytics.
100 visitors/day …every day
The first obvious indication of unrealistic uniformity is found in the daily number of visitors to the site. This figure is usually highly variable, but for this site it was very consistently close to 100 visitors per day.
The huge variation in visitor numbers which occurred on 12th July will be discussed in detail later in this blog.
Optimise Smart
In the context of Google Analytics, fake traffic is defined as one or more fake hits sent to your GA property.
A fake hit is the one which is generated by a program or a bot instead of the result of a living breathing human being who interacted with your website.
So many overseas “visitors”
The next suspiciously uniform parameter is demonstrated in the number of overseas visitors to the site.
Remember that this website was built for a small local business in Brisbane, yet it supposedly generated almost uniform number of visitors from nine overseas countries. This is absolutely beyond belief. We’ll see later that these figures were generated by a bot that is still producing the exact same figures to the Google Analytics property – even after the website has been shut down.
All visiting the same pages
There are so many instances of unreasonable uniformity demonstrated within these analytics. Let’s look at just one more …the pages supposedly visited.
We’ll discuss these page visits further, but for the moment, notice that of the 21 pages that made up this site, only seven pages (outside of the home page) were actually visited. These were all visited approximately the same number of times.
In this table we are seeing the effects of two different bots which we will now discuss.
Any person who can benefit financially, in any shape or form, by sending fake traffic can send fake hits to your GA property.
Optimise Smart
Obvious invalid traffic
Two bots involved
As I delved further into the Google Analytics of this site, it became evident that there two different bots producing fake hits on the Google Analytics property.
These are demonstrated in the image above. The most dramatic are the monthly bot-generated traffic spikes. The largest spike in the image represents the traffic generated on 12th July as discussed above. Similar (although smaller) events also occurred in June, August, September, November and December.
The analytics clearly show that this spike occurred between 10pm and midnight on the date and that the geo location of the source was supposedly a range of Australian capital cities and larger regional towns.
The second bot is a little less clear in it’s action, but I suspect that it is simply sending some form of ghost traffic to the Google Analytics property.
The interesting thing about this second lot of invalid traffic is that the analytics are still (at the time of writing this blog) appearing every day in the Google Analytics property – even though the actual website is no longer on the same server; the domain records now point to a different IP Address; and it’s not possible for human traffic to even find the site that has this Google tracking code installed.
Gallery of images of Ghost Traffic
The following gallery shows snippets of GA reports relating to the on-going ghost traffic.
A brief explanation of each is contained in the caption.
Clicking on any image will open it up full size in a lightbox.
What’s the point?
By now you might be asking “Why would anyone be interested in corrupting my Google Analytics?”
As the Deep Throat character ad-libbed to the Bob Woodward character in the 1976 movie “All The President’s Men”: “Follow the money …just follow the money”.
If anyone has any form of financial interest in boosting traffic figures to your website, it is quite easy for them to manipulate the data in any number of ways.
This might be the case, for example, where someone is commissioned to improve the SEO on your site and they could inflate the traffic figures to make their efforts look impressive.
It could also be the case with certain types of affiliate marketing arrangements.
What should I do?
In concluding this post, we need to consider how to respond to this issue of fake or invalid traffic on our websites.
Whether you need to take any action will depend upon exactly how the website is being used and how it is being affected by fake traffic.
In some cases, I have even disconnected Google Analytics altogether from a site simply because the analytics were not useful for the operation of the site.
In other cases, I have setup filters to prevent the display of ghost traffic or even installed Fou Analytics to allow a more in depth study of the invalid traffic.
If you need help with analytics of your website, please don’t hesitate to contact me directly.
Conclusion and Disclaimer
The website used as an example in this blog has now been re-developed on a different server based on the Google Cloud Platform here in Australia. The Google Analytics reports are now not affected by the invalid traffic detailed in this blog. They don’t look nearly as impressive as the analytics reported above …but they are real and they are showing slow growth in traffic as the SEO starts to draw more real Search traffic to the site.
I have not sought, or discovered, any proof concerning who might be responsible for initiating the bot traffic to the site before it was re-developed …and I make no claims about who might have been responsible.
PostScript
This blog was shared on LinkedIn and was graciously responded to by Dr Augustine Fou. In his response, Dr Fou listed some further tips to help in finding botnet traffic on your website through examining analytics. He also linked to a few other very helpful articles he has published.
I highly recommend that you check out his response here.
