What is the referral traffic from 127.0.0.1:8888/orange.html in Google Analytics?
Strange Referral Traffic in Analytics: 127.0.0.1:8888/orange.html
TL;DR Version:
It looks like it could be a Google crawler, although it is inconclusive at this point. We recommend you filter the traffic out as it brings no value to your data.
JUMP TO FILTERING INSTRUCTIONS
Sometime around mid-January we started to notice a spike in referral traffic for a few of our clients. My first thought was – “awesome, someone is linking to the site”. When I looked further into it I found that the spike in traffic was in fact coming from “127.0.0.1:8888/orange.html” – a localhost IP? Something wasn’t right.
I wasn’t too worried at this point, as the traffic numbers weren’t large enough to put too much of a skew on the data. I decided to look at the referral traffic for some of our other clients and found that there were a few seeing the same patterns. I spoke with some of the team in the office and none of them had come across this before, so I took it upon myself to do some digging.
Here’re the key facts at this point:
- Unusual referral traffic coming from a localhost-looking IP address
- Relatively small number of sessions
- 100% bounce rate
- 1.00 pages per session
- 00:00:00 session duration
Where’s the 128.0.0.1:8888 referral traffic coming from?
At this point, looking at the facts and figures, it’s fairly obvious that this is some kind of crawler / bot. Is it something to be concerned about? Probably not, but let’s do some more digging and see what we can find.
To make things a bit easier for myself, I created a segment to filter traffic so only this referral traffic was showing. Here’s a screenshot of the segment setup, in case you want to do the same:
In the Audience > Geo > Location tab I found that all the traffic is coming from the USA – more red flags. Most of the client’s accounts I checked are Australia / NZ based, and don’t tend to see much traffic from the US.
Drilling down a little further, the traffic appears to be coming from Michigan mainly, specifically Detroit, Rockwood and East Lansing; some have reported the same sort of traffic coming from California too. As well, the Service Provider of all this traffic shares the name “google llc”.
While initially things were quiet online about the traffic, various threads started to appear with people questioning the validity of the referrals, many experiencing almost identical findings to what we had seen here at Alpha Digital.
Some have seen a correlation with Analytics accounts that are also linked with / using AdWords. Having another look at the Behaviour data, it seems that theory could be feasible. We’ve seen some key pages – pages we would / do also run ads for – getting the referral traffic appearing. With others investigating further, they’re reporting similar things; perhaps this is a new Google crawler testing pages to ensure they are valid and suitable for Google ads?
Delving deeper into the Google theory, it became apparent that there are indeed Google offices in Michigan (and of course California), specifically Detroit.
Image taken from the Google careers page: https://careers.google.com/locations/
It looks like this might actually have a leg to stand on, so to speak. Let’s do another fact check and see where we’re at.
Facts at this point:
- 99% sure this is a bot due to its activity
- All traffic from USA
- Most of traffic from Detroit, Michigan
- Pages ‘viewed’ seem to correlate with pages in AdWords ads
- Service Provider is “google llc” for all traffic
- Google have offices in Michigan, specifically Detroit
It’s tough to determine whether or not this really is a Google bot, or if it’s a spam bot created to look like a Google bot; either way, it brings no value to the data being collected in Analytics. I’ve spent too much time looking in to this: let’s get rid of it and get back to work!
How to Stop Traffic from “127.0.0.1:8888/orange.html”?
Now that we’ve determined this is useless data, let’s create a filter to make sure it doesn’t bother us again. At Alpha Digital, we use a “master filter” that removes all the common spam traffic, along with any extras we’ve come across over the years. For the purpose of this post, let’s create a new filter.
Before you go any further, there are some important things to note:
- Google recommend you always have an unfiltered view, so you can refer to your complete dataset, and in case you accidentally filter anything important
- Once data is filtered from a view, it cannot be un-filtered – it is gone (hence why you should keep an unfiltered view)
BUILDING THE FILTER
- Firstly, head to Google Analytics and into the Admin section (last menu item in the left-hand menu, or the ‘gear’ icon).
- Then, in the far-right column of options, click the ‘Filters’ tab, and then “+ Add Filter”.
- Give the filter a name – whatever works for you – then fill in the fields as follows:
- Filter Name: [Relevant and obvious naming convention]
- Filter Type: Custom – Exclude
- Filter Field: Campaign Source
- Filter Pattern: 127\.0\.0\.1:8888
Important: be sure to copy the filter pattern exactly as above – the backslash characters (“\”) are ‘escape characters’ and are required for the filter to work correctly. - Hit the Verify This Filter link towards the bottom of the page to make sure the filter worked. You should see something similar to the following:
- If not, retrace your steps and see if you missed something – are you sure you copied everything as above (excluding the name)?
- If you see a table as the one above, you’ve successfully created a spam-bot filter. Hit Save to make sure your handy work gets put to good use, and those bots don’t come back to skew your precious data!
Is there anything I missed? I’d be interested to know if anyone has had any similar but not-quite-the-same referral traffic incidents like this one. Send us an email and let us know. I’d be happy to add to this post if there is anything else that needs mentioning or clarifying.