: Block spam from Google Analytics Measurement Protocol for Mobile Application I'm not sure if this is quite the right place to post this, but it seemed the most appropriate! I'm using Google

@Caterina187

Referral spam is a big problem in GA right now and I recently read something discussing "ghost referrals" and how they simply send hits to GA servers without ever visiting the site (it explicitly discussed the measurement protocol and how vulnerable it was).

I have never used GA on an app but let me share my experience in case it helps:

Don't use a GA ID ending in "1." Every GA account at some point had a profile ending in 1, like UA-XXXXXXX-1. So spammers just write programs that send hits to GA servers for every variation of UA-XXXXXXX-1--creating a new profile in the same account would give you UA-XXXXXXX-2 and would likely avoid most ghost hits.

Ghost referral hits are the ones filtered by the hostname filter but there are also actual crawlers that are responsible for referral spam, perhaps best known is semalt(dot)com.

Actual crawlers can be blocked by server configuration or blocking rules based on referrer in Google Tag Manager.

The hostname filter for ghost referrals is a whitelist approach but you can also set up filters by taking a blacklist approach where you exclude traffic from any source--if you have to go this route be prepared to add a new exclusion or few every week.

Vote Up Vote Down

@Jennifer507

The best way top avoid this is to set up a segment for you property such that is only includes data with a specified Application ID.

Now, simply send that Application ID with every hit that you send to Google Analytics and it will be included. The spammers won't know what application ID to use and so all their traffic will be blocked from that segment view.

Also, as mentioned by adam-asdf:


Don't use a GA ID ending in "1." Every GA account at some point had a profile ending in 1, like UA-XXXXXXX-1. So spammers just write programs that send hits to GA servers for every variation of UA-XXXXXXX-1--creating a new profile in the same account would give you UA-XXXXXXX-2 and would likely avoid most ghost hits.

Vote Up Vote Down