UPDATE 3/1/2024
If you’re looking for a workaround to filter out the newly blocked data on your reports, read our new blog. In that blog, we also teach you how to create report filters and save them for your team’s use, now and in the future.
UPDATE 2/23/2024
There are now more hits from other referral sources in addition to the information you see below. The process still works, but ultimately, the Google GA4 Team will need to address these issues, and hopefully soon! For now, our community is seeing hits of the same nature from the following sites (x replacing last character, as to not give them backlinks):
- info.seders.websitx
- ofer.bartikus.sitx
- game.fertuk.sitx
- garold.dertus.sitx
- kar.razas.sitx
- trast.mantero.onlinx
- static.seders.websitx
- and more…
Yes, you would have to add all of these following the same process, with different IP addresses! Here is the list of IPs we found to also block:
- 54.149.229.186
- 44.237.81.149
- 54.148.22.225
- 54.186.203.133
- 38.180.120.84
- 77.222.40.224
- 45.140.19.173
We will update our approach and share as we learn of new battle tactics. Stay vigilant!
Noticing a Huge Spike in Referral Traffic in GA4 from Poland?
In our routine analysis of multiple Google Analytics 4 (GA4) accounts that we oversee, we recently identified an unexpected and significant increase in referral traffic across a number of these accounts. This unusual activity prompted a detailed investigation to pinpoint the origin of this surge.
What is news.grets.store?
According to our research, “news.grets.store” is a malicious spam site based in Poland. This source stands out from conventional spam or backlink sites; it appears to be directly interacting with GA4 tags, resulting in an inflated count of ‘referral traffic’ from Poland. This kind of traffic is marked by a complete absence of genuine site interaction or visitor engagement, such as time spent on the site. This not only skews the referral traffic metrics but also impacts other critical analytics, leading to a misleading representation of site performance and visitor behavior.
The presence of such ghost traffic can severely compromise the accuracy of data analytics, making it challenging to draw reliable insights from affected GA4 accounts. It’s essential to address this issue promptly to maintain the integrity of your data and ensure that analytics continue to reflect genuine user interactions.
To remedy this problem, and block harmful sites like news.grets.store, follow these steps to stop news.grets.store from altering your Google Analytics 4 data:
Blocking the Referral
The first step in the process to safeguard your Google Analytics 4 (GA4) data from misleading spikes in referral traffic is to block the problematic referral source. This critical first step is foundational, setting the stage for any subsequent measures to effectively protect your analytics. Before advancing to further strategies designed to enhance the security and integrity of your GA4 data, it’s imperative to address the root of the disruption by intercepting and nullifying traffic from identified harmful sources, such as “news.grets.store.”
Blocking these referrals is not merely a preventative action but a necessary response to ensure that the data collected and analyzed in your GA4 accounts remains reflective of genuine user engagement. By eliminating the influence of these false traffic sources, you can restore the accuracy of your metrics and regain a true understanding of your site’s performance and visitor behaviors.
- Navigate to your GA4 account.
- Notice “news.grets.store / referral“. To see the referral – Use the Report Acquisition – Traffic Acquisition – then change the primary dimension to Session Source/Medium.
- Click “Admin“.
- Click “Data Streams” – here we will start with blocking the referrer.
- Click into the desired Data Stream – you may have multiple.
- Scroll down and click “Configure Tag Settings“.
- Click “Show More“.
- Click “List Unwanted Referrals“.
- Click into the “Domain” field and add in “news.grets.store“ & click “Save“.
Blocking the IP Address of the Harmful Site
Following the initial step of blocking the referral source to mitigate the impact of ghost/spam traffic on your Google Analytics 4 (GA4) data, the next critical phase involves targeting and blocking the IP address associated with the problematic traffic. This action serves as a more granular approach to ensuring that your analytics environment is shielded from malicious or misleading activities that could distort your data insights.
Blocking the IP address is an essential tactic in the broader strategy of data protection, as it directly prevents the identified source from sending any further deceptive traffic to your GA4 accounts. By implementing IP address blocks, you effectively create a more robust barrier against unwanted traffic, significantly reducing the likelihood of future disruptions to your analytics data. This step is vital for maintaining the integrity and reliability of your site’s performance metrics, as it helps to ensure that only genuine user interactions are captured and analyzed.
- Now, click into “Define Internal Traffic” – We will now block the IPs.
- Click “Create“.
- Name your rule.
- Change the drop-down to “IP Address Equals“.
- Add in the first IP “77.222.40.224”. Note that these may differ or get modified over time.
- Click “Add Condition“.
- Click the drop-down and change to “IP Address Equals“.
- Add in the second IP “45.140.19.173”. Note that these may differ or get modified over time.
- Click “Create“.
- Exit the Google Tag Pane.
- Close the Web Stream Details section.
- Click “Data Filters” on the left-hand navigation.
- Click “Testing” under the Current State column.
- Click the “Active” field.
- Click “Save“.
- Click “Activate Filter” on the informational pop-up.
How to Create a User Segment in GA4 to Use as a Filter
After diligently blocking the referral source and the associated IP address to protect your Google Analytics 4 (GA4) data from spam and ghost traffic, the concluding step in this comprehensive process is the creation of a user segment that will serve as a filter. This advanced measure allows for the refinement of your analytics, enabling you to isolate and exclude any residual unwanted traffic that might still find its way into your data, despite the initial protective barriers.
Creating a user segment as a filter involves segmenting your analytics data based on specific criteria that differentiate legitimate user interactions from the unwanted traffic previously identified. This could include behaviors such as the length of time spent on the site, the number of pages viewed, or more sophisticated markers of genuine engagement. By applying this user segment as a filter, you effectively refine your data analysis, focusing exclusively on insights derived from real, valuable user interactions.
This final step is crucial for restoring and maintaining the integrity of your GA4 analytics. It ensures that your data reflects accurate user behavior, free from the distortion of spam or ghost traffic. This filtered view of your analytics becomes an invaluable tool for making informed decisions about your website’s performance and user engagement strategies.
- To create a custom segment, click “Explore” on the left-hand navigation.
- Click any choice or start from blank.
- Click the plus sign next to Segments in the Variables column.
- Click the “User Segment” option.
- Click “Add New Condition“.
- Type in “Page Referrer” and select the first option in the drop-down.
- Click “Add Filter“.
- In the first field, select “Does Not Contain“. In the second field, type in “news.grets.store”. Click “Apply“.
- Click the “Untitled Segment” field.
- Type “news.grets.store – Segment Filter“.
- Click “Save and Apply“.
- Done!
Please be aware that this is only one potential solution for addressing the issues caused by ghost/spam traffic from this specific source. We understand there may still be challenges, and this approach might not suit everyone’s needs. Here is more information that I found in the Google Support Forumn from a user with a similar issue.
If you’ve also experienced an unexpected increase in referral traffic recently, we hope this advice has been beneficial! Have you encountered a similar situation in your accounts? Feel free to share in the comments if this strategy worked for you or if you have alternative solutions.
Thank you very very much!!!
You’re welcome!
I noticed the new traffic from Poland and yes thought something was not right. Thank you so much for this tutorial. I have no idea how to correct this. Many many thanks!
Absolutely! Happy to help!
Thanks for this, it was very helpful!
No problem! Hope you got it fixed!
Will the traffic suddenly stop or get blocked? Or will it take time to reflect it in GA4
Once you have run through the setup and saved, the traffic will be blocked. But unfortunately, the past hits will remain in your data.
Thankyou for your response.
Thank you!
You are welcome!
Thank you so much for the step by step tutorial; it was really easy to follow!!
You are welcome! More to come on reporting filters as well!
Thank you so much, I could not have done this without your straightforward instructions
You are welcome! Come back for updates as the more approaches evolve.
This is excellent. Do you have a way to filter out the traffic that it already sent? Lisa
Hi Lisa! I’ll have a blog with step by step custom report creation coming very soon!
What a great process!
Thank you so much! More to come as well!
This was very helpful! Very useful and well explained process.
Thank you. More to come so keep an eye out for updates!
I was under the impression that by using the “List Unwanted Referrals” in GA4 you were simply removing this traffic from being categorized as a “referral” to it being attributed as “direct” traffic instead.
Hi Amy, the process will eliminate the referrals and the IP blocking stops the data (but can require updates as or if IPs rotate/change). I’ll be posting another blog soon that walks you through creating custom reports/folders for your favorite reports that will exclude all past spam hits from your data! Hopefully this will satisfy until or if Google actually chooses to fix the problem for the world.
Thank you! I also have a lot of spam traffic coming from static.seders.website. How do I find the IP address? Or do I just block it in the ‘List Unwanted Referrals’?
Hi Amie! There are plenty of IP detectors out there so just google it. I have used NsLookup.io. We are certain to find more referral sites from other IPs utilizing this same spam tactic so a constant update to these tactics is necessary unless Google actually steps in and provides a solution and data redaction. Lastly, just published a new process on how to create reports that block out these spam hits so check it out!
This has been the most helpful and comprehensive help I’ve yet found to address this ongoing issue. Thank you for the support. Now there is traffic from rida.tokyox (x added so as not to create a backlink), too. They keep adding new ones.
Hi Rachel, yes, it will keep evolving unfortunately. Hoping Google decides to address the situation and clear out all the spam hits but who knows!
Thank you for sharing this! Hoping Google will resolve this issue. In the meantime, is there a way to apply this filter to custom Explorations?
Hi Destiny,
You would need to create a Custom Segment within your Exploration. Unfortunately, it must be done on each Exploration but it you find a smarter, faster way, then please share so we can all take a look!
I actually found a work around to exclude these from explorations! Add Country as a dimension then create a filter “country contains United States.” Removes all spam traffic from your explorations. Of course, you have to do this for each report but once it’s there, it’s there.
This was such a big help, and it was so easy to follow. Thank you so much.
Hi Danielle,
Glad we could help! Thank you for the comment!
Yeah, I also got this spam. Thanks for helping me filter out the bots from my data.
You bet, Cody! Glad we could help!
THANK YOUUUUU!!!
You are welcome!!!