In the past month, you might have noticed some strange data in your Google Analytics reports.

Many websites, including Manning Digital, have seen an unexpected spike in referral and social traffic. It gets even stranger when you look at where this referral traffic is coming from. Many of these referral sites have domain extensions of .xyz. When looking at the top languages set, there one that seems wildly out of place: “Secret.ɢ You are invited! Enter only with this ticket URL. Copy it. Vote for Trump!” We decided to do some digging into where this referral traffic is coming from, what analytics it is effecting, and how to best remove it.


Taking a closer look

First we created two segments to compare the traffic to all other traffic. The first segment, which we called “Trump referral spam,” was set up to include all traffic whose set language exactly matches the “Secret.ɢ” full phrase. The second segment was set up to include all traffic whose language was not set as the full phrase.

We first decided to see where the Trump referral spam was coming from geographically:spam-location-russia

Essentially 100% of the spam traffic was coming from Russia.

Here is the overview of the audience data for the Trump referral spam vs. non-referral spam:


As you can see, the Trump referral spam has a much longer average session duration and a much higher percentage of new sessions than the non-referral spam. The latter indicates a set number of IP addresses is accessing the website multiple times.

Now let’s take a look at the acquisition channels overview:


The Trump spam is a mixture of referral and social traffic. It contains no hits to the website from direct traffic or organic search.

Now let’s look at where that spam referral and social traffic is coming from, first focusing on the referral channel:


In addition to a slew of junk domains with an .xyz extension, there are two fairly reputable looking referral sites—lifehacĸ and (Google’s parent company). However, upon closer look, the lifehacĸ site is not as reputable as it seems—it uses the cyrillic ĸ instead of the roman character k; it is not

Now we move onto the social channel:


Again, we see two fairly reputable sources for our social channel data.


What are the consequences of this spam traffic?

The most important thing to note is that spam traffic cannot cause your website any damages in terms of SEO. The motivation of the spammer is to get your attention and try to get you to visit Secret.ɢ However, spam traffic of this volume can cause a distorted picture of your analytics. This might cause you to make strategic decisions about your website based on false data.


How can you remove the spam?

Unfortunately, there is no way to scrub the traffic that has already occurred. What you can do is set up a filter to sort out all future spam traffic. Under your account’s admin tab, you should click on “All Filters.” Click on the “Add Filter” button. You should create a custom filter that excludes Language settings that are set as “Secret.ɢ You are invited! Enter only with this ticket URL. Copy it. Vote for Trump!” The filter should look as is below:


You will want to apply this filter to each of your available views. Battling referral spam is a constant battle that requires vigilance to what filters you should set in order to get the most accurate picture of your analytics possible. Feel free to send us a note if you would like to learn more about tackling your website’s analytics.

Leave a Comment