In the last 8 months or so, I've been noticing an increase in suspect traffic in GA. I first noticed it when we started seeing higher than usual Wyoming traffic. Now, Wyoming has gone from bottom 5 for traffic to regularly appearing in the top 5 and the issue has become substantially worse in the last month or so. I've tracked it back to having really started at the beginning of 2018.

When I started investigating the issue further, I noticed that the unusual traffic all comes from six cities:

  • Cheyenne, WY

  • Quincy, WA

  • Des Moines, IA

  • San Antonio, TX

  • Washington, VA

  • Chicago, IL

A large amount of traffic from these cities as well as traffic that has (not set) for location, lists a service provider of "Microsoft Corporation" in GA. Bounce rates for this traffic don't seem particularly unusual (70-75% for the most part), but average session duration is incredibly low considering that pages/session averages 1.5. This session duration is not in line with all other traffic (average for the site is about 1 min, 40 sec). I have set GA to not include known bots and spiders.

The traffic does seem to correspond to days when emails are sent for the most part, and clicks on the email and sessions recorded in GA do tend to align pretty well. So even though it looks like a bot, my concern is that it is somehow legit traffic that is simply being recorded incorrectly in GA (location, session duration). I don't know if that's even possible, though.

Does anyone know what this traffic is? I don't want to exclude it without understanding what it is. I have included a screenshot of a custom report that shows the traffic for the last week.

enter image description here

  • With it being Microsoft, could it be Bing bots? – Chris Rogers Aug 1 '19 at 21:06
  • @ChrisRogers. Maybe, but does that make sense considering this traffic spikes when we send out a newsletter? – matthew_b Aug 2 '19 at 12:19
  • check your access log and find some IP address related to this requests. then you can make sure is it bot or real humans ? you can get information of each IP using ipinfo.io website. – Shyamin Ayesh Aug 6 '19 at 20:02
  • 1
    Might be a spamfilter checking if the domain the newsletter mails come from is somewhat ok? – Pit Aug 8 '19 at 5:48

One more thing you can check is screen resolution, i have had similar issues on some of the sites but it was Facebook instead of Microsoft. The screen resolution was 2000x2000 with 100% bounce rate. Than it is easier for exclusion as well.

|improve this answer|||||
  • 1
    Thanks @Filozof666. This actually helped me narrow down the traffic a bit more. There are two resolutions most of it is coming in as: 1280 x 920 and 1024 x 768. The 1280 x 920 is nearly 100% bounce and I'm going to look to exclude that. I'll have to see about the other one as the bounce rate is more reasonable. – matthew_b Aug 12 '19 at 11:51
  • I'm getting a bunch of traffic from Microsoft Corp. (Azure) from MSIE 9.0 and Trident/5.0; Trident/5.0 in the user agent twice, two spaces between. No referrer and nearly 100% bounce rate. 1024x786 screen resolution. I have "exclude known bots" checked. – Collin Anderson Sep 17 '19 at 21:12

As per the resources available under this specific topic on the internet it seems these are the traffic coming from Microsoft's Bing search engine bot. You can easily identify/verify them using the following ways.

Try to pull the access log information for one of these request and get the IP address of that specific access log entry. Then you can try to verify it using following verification tool.

Bingbot : https://www.bing.com/toolbox/verify-bingbot

If you need to remove these bot traffic from your Google Analytics reports you have to enable bot filtering option in your GA property view settings.

exclude bot traffic google analytics

tick the Exclude all hits from known bots and spiders to remove these traffic from your view.

|improve this answer|||||
  • I do have the bot filtering enabled, so it doesn't seem to be that simple. Is there a place in GA to check the IP address? I thought that information wasn't recorded. – matthew_b Aug 7 '19 at 18:54
  • opps. try checking the server access logs to get the IP address. – Shyamin Ayesh Aug 8 '19 at 20:49
  • I did manage to find one offending IP address, but unfortunately, it's not a Bing Bot according to the link you provided. It does appear to be from Microsoft Azure as pointed out in another answer. – matthew_b Aug 12 '19 at 11:48

Those are hits from Microsoft Cloud. They could be bots, and could be not. I would decide whether to exclude them on their monetary value (revenue, leads, any other kind of conversion). If they convert - don't exclude, if not - exclude.

|improve this answer|||||

Set the service provider as the primary dimension and see if you can find something interesting using the other dimensions. I would check the browsers, devices, IP addresses, screen resolutions, where the traffic is coming from, and other engagement metrics. If it is a bot it will be very similar.

It could be a VPN service?

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.