2

In the last 8 months or so, I've been noticing an increase in suspect traffic in GA. I first noticed it when we started seeing higher than usual Wyoming traffic. Now, Wyoming has gone from bottom 5 for traffic to regularly appearing in the top 5 and the issue has become substantially worse in the last month or so. I've tracked it back to having really started at the beginning of 2018.

When I started investigating the issue further, I noticed that the unusual traffic all comes from six cities:

  • Cheyenne, WY

  • Quincy, WA

  • Des Moines, IA

  • San Antonio, TX

  • Washington, VA

  • Chicago, IL

A large amount of traffic from these cities as well as traffic that has (not set) for location, lists a service provider of "Microsoft Corporation" in GA. Bounce rates for this traffic don't seem particularly unusual (70-75% for the most part), but average session duration is incredibly low considering that pages/session averages 1.5. This session duration is not in line with all other traffic (average for the site is about 1 min, 40 sec). I have set GA to not include known bots and spiders.

The traffic does seem to correspond to days when emails are sent for the most part, and clicks on the email and sessions recorded in GA do tend to align pretty well. So even though it looks like a bot, my concern is that it is somehow legit traffic that is simply being recorded incorrectly in GA (location, session duration). I don't know if that's even possible, though.

Does anyone know what this traffic is? I don't want to exclude it without understanding what it is. I have included a screenshot of a custom report that shows the traffic for the last week.

enter image description here

4
  • With it being Microsoft, could it be Bing bots? Aug 1, 2019 at 21:06
  • @ChrisRogers. Maybe, but does that make sense considering this traffic spikes when we send out a newsletter?
    – matthew_b
    Aug 2, 2019 at 12:19
  • check your access log and find some IP address related to this requests. then you can make sure is it bot or real humans ? you can get information of each IP using ipinfo.io website. Aug 6, 2019 at 20:02
  • 1
    Might be a spamfilter checking if the domain the newsletter mails come from is somewhat ok?
    – Pit
    Aug 8, 2019 at 5:48

5 Answers 5

2
+50

One more thing you can check is screen resolution, i have had similar issues on some of the sites but it was Facebook instead of Microsoft. The screen resolution was 2000x2000 with 100% bounce rate. Than it is easier for exclusion as well.

2
  • 1
    Thanks @Filozof666. This actually helped me narrow down the traffic a bit more. There are two resolutions most of it is coming in as: 1280 x 920 and 1024 x 768. The 1280 x 920 is nearly 100% bounce and I'm going to look to exclude that. I'll have to see about the other one as the bounce rate is more reasonable.
    – matthew_b
    Aug 12, 2019 at 11:51
  • I'm getting a bunch of traffic from Microsoft Corp. (Azure) from MSIE 9.0 and Trident/5.0; Trident/5.0 in the user agent twice, two spaces between. No referrer and nearly 100% bounce rate. 1024x786 screen resolution. I have "exclude known bots" checked. Sep 17, 2019 at 21:12
2

As per the resources available under this specific topic on the internet it seems these are the traffic coming from Microsoft's Bing search engine bot. You can easily identify/verify them using the following ways.

Try to pull the access log information for one of these request and get the IP address of that specific access log entry. Then you can try to verify it using following verification tool.

Bingbot : https://www.bing.com/toolbox/verify-bingbot

If you need to remove these bot traffic from your Google Analytics reports you have to enable bot filtering option in your GA property view settings.

exclude bot traffic google analytics

tick the Exclude all hits from known bots and spiders to remove these traffic from your view.

3
  • I do have the bot filtering enabled, so it doesn't seem to be that simple. Is there a place in GA to check the IP address? I thought that information wasn't recorded.
    – matthew_b
    Aug 7, 2019 at 18:54
  • opps. try checking the server access logs to get the IP address. Aug 8, 2019 at 20:49
  • I did manage to find one offending IP address, but unfortunately, it's not a Bing Bot according to the link you provided. It does appear to be from Microsoft Azure as pointed out in another answer.
    – matthew_b
    Aug 12, 2019 at 11:48
2

Those are hits from Microsoft Cloud. They could be bots, and could be not. I would decide whether to exclude them on their monetary value (revenue, leads, any other kind of conversion). If they convert - don't exclude, if not - exclude.

1

Set the service provider as the primary dimension and see if you can find something interesting using the other dimensions. I would check the browsers, devices, IP addresses, screen resolutions, where the traffic is coming from, and other engagement metrics. If it is a bot it will be very similar.

It could be a VPN service?

0

We were having the same issue, however Analytics was no longer showing any values for "Service Provider" - fortunately all our 100% bounce rate traffic was coming from extremely old versions of Chrome, eg a quarter of our traffic suddenly came from "Chrome/64.0.3282.140". This made it easy to track down to two blocks of IP addresses: 40.74.0.0 - 40.125.127.255 and 20.33.0.0 - 20.128.255.255

We added in IP blocks to Apache via .htaccess which removed it.

deny from 20.33.0.0/16
deny from 20.34.0.0/15
deny from 20.36.0.0/14
deny from 20.40.0.0/13
deny from 20.48.0.0/12
deny from 20.64.0.0/10
deny from 20.128.0.0/16
deny from 40.74.0.0/15
deny from 40.76.0.0/14
deny from 40.80.0.0/12
deny from 40.96.0.0/12
deny from 40.112.0.0/13
deny from 40.120.0.0/14
deny from 40.124.0.0/16
deny from 40.125.0.0/17

Looking at the access.log's for these IPs and browser versions, it does appear to be an actual Chrome browser being used, connecting on HTTP/2, following redirects, downloading JS/CSS/images. Very confusing as to what would be generating all this traffic and why.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.