I was reviewing my Analytics for the past year and noticed a couple dozen different IP addresses showing up as referrals. I tracked a few of them down to be Google (why are Google IP addresses coming in as referrals?), but there are still quite a handful that come from "private" IP addresses:




for the 10.x.x.x range of IP addresses, they are all using Port 15871 which I found interesting. I have the company IP address blocked from Analytics, so it shouldn't be any internal visits. Any clue what's going on here?

3 Answers 3


As indicated in this Google Product Forums answer, Google Analytic servers cannot see private IP addresses.

It's quite possible that these are spoofed IP addresses. Port 15871 by the way is commonly used by Websense's Web Security and Web Filter, which they may be attempting to exploit.

To exclude internal IP addresses from appearing in your reports, follow the instructions from this Google Analytics Help article:

Create a custom filter to exclude a specific IP address or a range of IP addresses.

Filter Type: Custom > Exclude

Filter Field: Visitor IP Address

Filter Pattern:

  • For example, if the single IP address is, then enter

  • For example, if the range of IP addresses is and, then enter ^176.168.1.([1-9]|1[0-9]|2[0-5])$|^10.0.0.([1-9]|1[0-4])$

Remember to use regular expressions to enter an IP address.

You can also use or modify the regex of the code found here.


In general, this kind of referrals refers to this situation: when a developer is working on local on a new version of a site, if he clicks on absolute link on a page (when testing), he is redirected to a page which is online. That's why the script of Google Analytics gets this kind of IP address as referrals.


Referrers are just an information the browser sends to the site and you can't rely on them being accurate. So there could be many reasons for that:

  • maybe some people are using RSS readers or webmails running in there local networks and linking to your site
  • people could just be faking their referrers because they don't want to send the real ones
  • development instances of your site running in a local network an linking to your real site

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.