Is it possible to Spoof Analytics to give false Unique Visitor Data for Site A to Site B

[James77]

Hi,

We are working as a middle man between our client (website A) and another website (website B) where, website B is going to host a section around websites A products etc.

The deal is that Website A (our client) will pay Website B based on the number of unique visitors they send them.

As the middle man we are in charge of monitoring the number of Unique visitors sent though and are going to do this by monitoring Website A's analytics account and checking the number of Unique visitors sent.

The deal is worth quite a lot of money, and as the middle man we are responsible for making sure that no funny business goes on (IE false visitors etc). So to make sure we have things covered - What I would like to know is

1/. Is it actually possible to fool analytics into reporting falsely high unique visitors from Webpage A to Site B (And if so how could they do it).

2/. What could we do to spot any potential abuse (IE is there an easy way to spot that these are spoofed visitors).

Many thanks in advance

[Jinx14678]

You might be better with a server side tracker like http://awstats.sourceforge.net/

The answer from Mat probably has the best logic, but the only problem is are you legally responsible for mitigating the possibility of fraud?

I would make sure you add this to the contract, as I am not sure you are going to be able to defeat a proxy or spoofer, just in case the referrer gets smart and decides to work the system.

An anti fraud system can be put into place, but LOL I am not sure you will have the access to the multi million dollar fraud monitoring tools that Google does, that are contstantly updated and algorithmically and systematically monitor as well as have auditors who manually do random checks...

[James77]

Hi - Well we are really just acting on behalf of the client - that's what they want.

Also its only visitors from that specific website (very close niche) - not just any site

[matbennett]

Google Analytics doesn't report IP Address though - which is another reason to take a different root. Not knocking GA, I love it. However it isn't the right tools for this.

I suspect that the fiverr gigs use ping or something the create the mass of "unique visits". Very easy to spot.  Unless you have some fairly sophisticated tools to hand i'd imagine that any method that can deliver 5000 for $5 is going to be pretty easy to spot.

Might try it now though.  I love fiverr for testing stuff

[YNWA]

If you must use Analytics, I would drill down to the source of referral within analytics. This will give you the URL, page, or whatever. I think you can also drill down to the referring IP etc...

You need to log were they come from through them. Export your results every month and see a pattern.

If you get 500 referrals from website B's IP or URL, then its a sure way of knowing they are throwing people at you.

But Mats answer is best, will give you times, not just dates and will also give you more detailed info.

[KeriMorgret]

My question is: is unique visitors the right metric that you should be measuring? On Fiverr.com I can get 2000 to 10,000 unique visitors for $5. http://fiverr.com/gigs/search?query=unique+visitors&x=0&y=0

Can you tie your metrics to something else that might have more value for you, such as purchases, newsletter signups (still easy to fake, but at least takes a little more time), etc?

[matbennett]

Google Analytics isn't designed to pull the data in the way you really want to for something like this. It can be done I suppose, but it'd be hard work.

There are only so many metrics you can measure, and all are pretty easy to fake. However having the data is an easy to access form means that you can spot patterns and behaviour, which are much harder to fake.

Probably a starting point would be to measure distribution of the various metrics on the referred traffic v the general trend. If one particular C class block (or user agent, or resolution, or operating system, or whatever) appeared at a different frequency in the paid traffic that would be a good place to look deeper.

Thinking less technically for a moment though, I bet you could just implement one of the many anti click fraud systems to do most of this for you. same idea, but someone else has already done the coding. Googling for click fraud brings up a stack of ads (tempting to click them loads and set off their alarms!!).

[James77]

Hi Mat,

A very informative answer.

If someone is going to try and spoof analytics, then would they not also be able to equally try and fool the script?

If someone was to try this do you know how they would likely try and do it - essentially if I know what is likely to be tried, then I can work out something that could counteract it. Are there certain things that can't be fooled, or are very difficult to fool ? - EG things like browser resolution, location etc - or are this just as easy to spoof as anything else?

many thanks

[matbennett]

It isn't hard to fake this at all I am afraid. Spotting it will depend on how sophisticated the person doing it is.

My personal preference would be not to use analytics as the means of counting it. Doing that you are going to be slightly limited in the metrics you have available and will always be "correcting" data and looking for problems rather than measuring more correctly and having problems spotted.

I'd have a script on page that logs that checks for a referrer and it if matches the pattern for website B creates a log record instead.

You then have the ability to set your rules. For instance if you get 2 referrals from the same IP a second apart would you count them? What about 10 per hour 24 hours a day? You can also log the exact timestamp with whatever variables you want to collect, so each click from the referring site might be recorded as:

• Time stamp
• Exact referring URL
• User agent
• IP
• Last visit (based on cookie)
• Total visits (based on cookie)
• #pages viewed (updating cookie on subsequent page views )
• and so on

Analytics doesn't give you access to the data in quite the same way. I'd definitely want to be logging it myself if the money involved is reasonable.