Suspect Gallery

A while ago, I was looking at Google Analytics for a young website and I noticed a spike in traffic. This is usually a social media mention. but I noticed it was due to a new traffic source: “”. That didn’t look right.

This article will show you how to identify bad bot traffic using free tools. You need to know how to line up a suspect gallery.

Using Google Analytics Acquisitions To View A Suspect Gallery

Don’t be daunted if you rarely use the Google Analytics tool. It just takes a few clicks for our purposes

There are two great ways to assemble a suspect gallery of bad bots within Google Analytics. The first way is to use the Acquisition Report.

You’ll see Acquisition listed under the Reports section on the left-hand side of the page.

Click on Acquisitions to expand the options, and choose “All Traffic”. From there, click on “Referrals”. Now you are exactly where you want to be.

You can tinker with the date options to narrow down the date range to isolate the spike. I’ll get right down to the day. This narrows down the suspects in your Suspects Gallery.

You can see below that the dodgiest-looking suspect is at the top of this list. This is because I narrowed it down to a single day. You can consider the other referral sources to be the innocent members of the gallery.

Facebook and YouTube are desirable sources. And is the RSS feed.

Recognizing Bad Bots In The Suspect Gallery

“”. Just the name of it sounds spammy. But that’s exactly the point.

The creators of this bot want you to recognize that it is sending you free traffic. They are trying to attract the attention of website owners who want to inflate their traffic for free. But why?

Firstly, interested website owners will go to the website to check it out. Hey presto! They have generated traffic to their own site.

Secondly, there’s probably some kind of signup form to order more traffic. I strongly advise against engaging with this. And not just because it’s against the rules of Google and all reputable advertisers. You may find yourself the target of viruses and other nefarious activities if you get involved.

Other variants in the Suspect Gallery

You may see entries with different extensions, like “”.

There are similarly named bandit bots like “Getbottraffic4free”. They are not difficult to spot as being bandits.

Using Google Analytics Countries To View A Suspect Gallery

I set up a brand new WordPress site on the first of January this year and didn’t do much with it for a week. No about page, no content, nada.

But on its second day of creation, it had a little spike of 13 visitors.

In this case, the Acquisition Referrals report was empty.  So I switched to “Source/Medium” (directly above “Referrals) and saw that all the traffic was “direct”.

In other words, the brand new domain name had been entered into a browser address bar thirteen times within 48 hours of registration.

Geographic Location Report

With no clue from referrals, it was time to use a different report within Google Analytics: the Audience Geographic Location report.

Expand the Audience reports in the left-hand menu, and click on Geo. From here, choose the “Location” option.

This is what I saw: a suspect gallery with one suspect!

Yes, all the visitors were from just the one country i.e. China. What’s going on?

There are plenty of companies that track new domain registrations for various reasons. One of those reasons is to gather contact details from new websites. The purpose is to try to sell services like SEO or link exchanges to the website owners.

In order to get the contact information, these companies will use a bot to trawl the new website for emails or contact forms.

What To Do With Minor Suspects In The Gallery?

There was only one suspect in the gallery (using this report). Not a difficult case to solve!

Thirteen visits aren’t putting any strain on the host resources, and I wasn’t too bothered about it. It’s possible to block traffic from specific countries, but I didn’t see repeat visits after those first few days. I determined this to be a minor irritant and took no action.