Block spam from Google Analytics Measurement Protocol for Mobile Application

Question

I'm not sure if this is quite the right place to post this, but it seemed the most appropriate!

I'm using Google Analytics to track metrics from a mobile app using the Measurement Protocol, however I'm getting an awful lot of spam coming though.

A bit of searching led me to things like this: How to fight off Google Analytics referrer spammers? that basically suggest adding a filter that only lets through things from a known host name. This is fine for a website, but isn't very useful for a mobile app as there isn't really a 'host' that valid data should be coming from (or am i missing something?).

What's the best way of filtering out the GA spam for a mobile app using the Measurement Protocol.

Answer 1

Referral spam is a big problem in GA right now and I recently read something discussing "ghost referrals" and how they simply send hits to GA servers without ever visiting the site (it explicitly discussed the measurement protocol and how vulnerable it was).

I have never used GA on an app but let me share my experience in case it helps:

Don't use a GA ID ending in "1." Every GA account at some point had a profile ending in 1, like UA-XXXXXXX-1. So spammers just write programs that send hits to GA servers for every variation of UA-XXXXXXX-1--creating a new profile in the same account would give you UA-XXXXXXX-2 and would likely avoid most ghost hits.

Ghost referral hits are the ones filtered by the hostname filter but there are also actual crawlers that are responsible for referral spam, perhaps best known is semalt(dot)com.

Actual crawlers can be blocked by server configuration or blocking rules based on referrer in Google Tag Manager.

The hostname filter for ghost referrals is a whitelist approach but you can also set up filters by taking a blacklist approach where you exclude traffic from any source--if you have to go this route be prepared to add a new exclusion or few every week.

Answer 2

The best way top avoid this is to set up a segment for you property such that is only includes data with a specified Application ID.

Now, simply send that Application ID with every hit that you send to Google Analytics and it will be included. The spammers won't know what application ID to use and so all their traffic will be blocked from that segment view.

Also, as mentioned by adam-asdf:

Don't use a GA ID ending in "1." Every GA account at some point had a profile ending in 1, like UA-XXXXXXX-1. So spammers just write programs that send hits to GA servers for every variation of UA-XXXXXXX-1--creating a new profile in the same account would give you UA-XXXXXXX-2 and would likely avoid most ghost hits.