Everyone! It’s time to check your Google Analytics for Bot Spam from Amazon!

Amazon Bot Spam

Written by Nicola Bell

Nicola is the Digital Account Manager at GlowMetrics, preparing and executing PPC & SEO strategies for new and existing clients. Nicola specialises in integrated marketing campaigns, combining the best of paid social and paid search to get the finest of results for her clients
February 15, 2019

UPDATE: As of 4th February 2020, the ‘Network Domain’ and ‘Service Provider’ dimensions in Google Analytics have been marked as ‘no longer supported’ and are returning (not set) values – so filtering bot traffic just got a little bit tougher and some of the recommendations below may no longer be applicable. 

 

Bot Spam traffic in Google Analytics has EXPLODED in the last few years. We’re seeing it all the time in our clients’ accounts. More and more we’re seeing this bot traffic attributed to Amazon.

In fact, I was inspired to write this blog after a query from one of our clients:

“Why is there over a 30% difference in total users from our filtered GA view to our unfiltered view. I can’t believe it’s all spam”– said Client X.

It turns out the answer was spam and most of it was attributed to Amazon.

So, sit back, relax and prepare yourself to learn all about Amazon bot spam, how we find it and what we do about it.

Should I Worry About Bot Traffic in Google Analytics?

The short answer is: Yes. The longer answer is: Definitely. Yes. 100%. Why are you even asking? Are you serious?

We need to filter out bad bots from Google Analytics so that we can be confident that the data we report on (the traffic totals, behavioural insights and conversion rates etc) are really from human beings, not bots. Our clients are data-driven organisations, so the data that is driving their decisions MUST BE accurate.

How did we Find this Spam?

Some things we look for when trying to identify bot traffic in client accounts are:

  • Low site engagement
  • High bounce rates
  • No goal completion

 When you see all the above things, you might just have found yourself some spam!

 How to Check Your Google Analytics Account

In Analytics, navigate to Audience Technology > Network.

Add a table filter on Service Provider with a substantial amount of sessions (say 200+) and bounce rates higher than 90%.

amazon-bot-traffic-analytics-service-provider

Ahhh, here we see the usual suspect…Amazon. In this example, we have multiple variations of “traffic” from Amazon including “amazon technologies inc”, “amazon.com inc” and “amazon data services uk”.

Let’s look at the evidence. The “traffic” from these have some things in common: have very high bounce rates, low pages/session and average session duration of just 1 second or below. Looks suspicious, right? It’s because it is.

amazon-bot-traffic-analytics-service-provider2

Want more proof? Add “City” as the secondary dimension, and you will find that this “traffic” often comes from either Ashburn or Boardman – exactly where Amazon’s data centres are located.

amazon-service-provider-bot-boardman-ashburn

Don’t do a lot of business in Ashburn or Boardman? No? Neither does this client but as you can see, this client is getting a substantial amount of low-quality traffic from “Amazon”. But now – it’s not really from Amazon, is it?

How Did we Deal with this Amazon Bot Traffic?

1.    Enable Bot Filtering

Go to Admin > View Setting and tick the box to filter out “known” bots and spiders. This filter excludes all known bots/spiders listed by the Interactive Advertising Bureau. It provides some degree of protection but won’t fully protect your site against all bots and spam traffic. Still, it’s a good way to start protecting your site from known bots and spiders.

amazon-bot-filter-analytics

TOP TIP! Don’t enable this on your main reporting View. Create a Test View first, so that you can see what data is being excluded. It’s best practice to run tests on all filters including filters from Google.

2. Set up an ISP Domain Filter

Remember our screenshot above where we found that there was a substantial amount of suspicious traffic from “amazon technologies inc”, “amazon.com inc” and “amazon data services uk”?  Add Network Domain as the secondary dimension and you’ll see that the Network Domain for this traffic is “amazonaws.com”.

amazon-bot-isp-domain-filter

Using this data, we recommend creating an ISP Domain filter to filter out this traffic. This is what it looks like:

amazon-bot-isp-domain-filter2

 

Don’t forget to verify your filter to make sure it will work!

And there you have it, how to find and how to exclude bot traffic from Amazon!

What are your thoughts on spam traffic in Google Analytics? What precautionary measures do you take? Happy to hear your comments!

 

23 Comments

  1. Maureen

    Thanks for this info. Really insightful. While this will help with GA, the reason I checked your info is that I’m seeing an abnormal rhythm of spikes in Amazon reporting itself, that is not converting to sales – numbers go up 50 or so every 3 days. 2 days near zero, then next day 50 higher than the other 50. Any way I can deal with this? or shouldn’t I worry about it. Thank you!

    Reply
    • Nicola Bell

      Hi Maureen, thanks for the comment. We specialise in Google Analytics and why some analytics accounts may see increased bot traffic from Amazon. I think you’re talking about Amazon analytics, unfortunately, this wouldn’t be our area of expertise. Sorry, we can’t be more help!

      Reply
      • Maureen

        Thanks, Nicola. Much appreciated.

        Reply
  2. Crypto news

    Hello,
    Thanks for this article. I was also facing the same problem. My SMO service provided 1500 traffic in one day. I thought it is suspicious and checked and by reading this blog I got confirmed that it is bot traffic. Thanks for this update. However, there is a question I added isp domain as a filter but traffic didn’t remove yet. Please let me know the reason.

    Reply
    • Michael Wilson

      Any filters you add in Google Analytics will only work from the time they’re created – it is not possible to filter historical data, unfortunately…

      Reply
  3. Allie Williams

    Hello, do you ever see legitimate traffic from the amazonaws.com Network Domain?

    While I’m seeing the high bounce rates/low session duration for the majority of sessions from this ISP, I also see some sessions from “amazon corporate llc” and “amazon data services canada” where the bounce rate is 35-60% and the session duration is much longer (tens of seconds to minutes).

    Thanks!

    Reply
    • Michael Wilson

      Hi Allie,

      Anytime we’ve checked for amazonaws.com as the network domain, it’s looked pretty clearly like bot traffic. I don’t know for certain if all traffic from that network domain is always bot traffic though so that’s why it’s a good idea to check the engagement metrics as well.

      It is important to check a range of network domains, service providers, cities and so on in your Google Analytics data in order to work out the best approach to filter out as much bot traffic as possible for your specific scenario.

      There is always the risk of filtering out some real users but sometimes it’s for the greater good if you can clean out thousands of bot sessions, even if you lose a handful of legit sessions in the process.

      Reply
  4. Charles

    Thanks for this great article. Very insightful.
    My concern is not only cleaning GA report, it is more how to stop those bots surcharging my site.
    It is bad for performance and could also cost a lot of money.

    Reply
  5. Hayden

    Great article!I appreciate the insight on the the amazon bot traffic as I have been getting a ton of referral traffic from my commodity domain names out of the Ashburn amazon data center. What exactly are the purpose or goals of these amazon bots?
    Thanks!
    Hayden

    Reply
  6. Luke

    Hi there, I have implemented this as this is the exact thing I was seeing in my analytics account. Filter verification is where I am hitting a snag.

    Essentially, after the verification runs my “before filter applied” data looks fine but the “after filer applied” data shows nothing. Not even zeros.

    Any ideas as to why? I created a test view just in case it is working but I noticed this when I was curious what trying to verify it on the live view would look like.

    Thanks for the great resource!

    Reply
    • Michael Wilson

      Hi Luke,

      Your ‘after filter applied’ data shows nothing because the data is being filtered out. 🙂

      That’s how it’s supposed to look, don’t worry!

      Reply
  7. Bobbi

    I’ve got what looks like it could be bot traffic, however when I look under Technology>Network it shows Pinterest and the network domain is pinterest.com but it’s coming through as direct traffic and is all out of ashburn.

    Reply
  8. Lautaro

    Hello! I’m having a similar issue with a difference: most of the e-Commerce transactions come from this city. The e-Commerce conversion rate adds up to 160%.
    The transactions in Analytics is equal to the transactions in the e-commerce platform (only that in the e-commerce platform not even one transaction come from Ashburn).

    I’m thinking that this could be some kind of redirect of the payment gateway, but I can’t figure out how to solve it.

    Can you help me out?

    Reply
    • Joanne Kearney

      Hi Lautaro,

      Apologies- we missed replying to your comment! Can you let us know what payment provider you use? You might need to edit your property settings depending on this.

      Thanks,

      Joanne

      Reply
  9. Katie Rosenbaum

    Hi,

    I was recently told by our phone provider that they use “AmazonAWS” to push data through. They asked us to unblock the IPS AWS so that their data could come through, but I’m not sure I trust that. Have you ever heard of this before? Thank you.

    Reply
    • Michael Wilson

      Hi Katie,

      Hard to say without more info – i.e. what data are they trying to push through – but Amazon Web Services is a cloud platform so it could well be used for a legit purpose.

      Michael

      Reply
  10. Kamal

    I am getting such traffic from a long time but I dont see high bounce rate with this traffic. Bounce rate is 10% while pages per visit are also more. Though there are no link clicks but multiple pages visited per visit. It shows 300,271 sessions from amazonaws.com and 10.32% bounce rate and 15.11 pages/session.

    Is it still a bot traffic?

    Reply
    • Joanne Kearney

      Hi Kamal,

      When you segment this traffic (you can do this through building an advanced segment) are there significant peaks and dips in traffic or is the pattern of traffic flat?

      Joanne

      Reply
  11. Robert

    I will provide a different view on things regarding the AWS traffic bot spam…

    The quick backstory: In July 2017, I was spam e-mail bombed in my general, everyday Gmail account. I was thrust in to the world of learning about spam e-mail, DDoS, DoS, i. p. adresses, hosts, Registrars, etc. I fought a two and a half year battle to save my e-mail address. There however, was the nagging AWS spam from one host that AWS blatantly ignored, after that two and a half year battle.

    Just last week, out of being fed up, I contacted AWS’ Registrar Mark Monitor’s Abuse Department. Mark Monitor responded back saying I need to contact [email protected]. I sent two abuse complaints with headers to the Host Master and the spam e-mails from the infected host (no doubt it was a bot, as I too in my research came up with Ashburn, VA Data Center) stopped!

    So, if yourselves are having issues with filtering out the crawl bots, you could always e-mail [email protected] with your complaints, since e-mailing [email protected] and [email protected] is worthless.

    Reply
  12. Harry

    Thank you for a very helpful article. I’ve just received lots of hits from Ashburn after running a Pintrest pay-per-click campaign for my business. I’m a complete beginner to this so forgive my ignorance, but is this Pintrest trying to make more money from me by using fake clicks? What is the incentive for bots to visit my site otherwise?

    Reply
  13. Harry

    Perhaps you wont be able to publish my last post because I specified Pintrest so I have re-worded it below:

    Thank you for a very helpful article. I’ve just received lots of hits from Ashburn after running a Social Media pay-per-click campaign for my business. I’m a complete beginner to this so forgive my ignorance, but is the social media company trying to make more money from me by using fake clicks? What is the incentive for bots to visit my site otherwise?

    Reply
    • Joanne Kearney

      Hi Harry,

      Have you looked at the traffic to see the pattern of activity from Ashburn? Is it low average duration/page per visit/high bounce rate/peaks on certain days? We can’t say that it is 100% bot traffic but the likelihood is that it is- if it is from Ashburn and it has stood out enough to make you comment here!

      It is unlikely though, that this traffic that has been generated as a direct result from clicks that have been made on your ad that would have cost you more money. Normally ad platforms are good at filtering out invalid clicks (coming from irregular patterns in clicks from certain IPs). Did you tag the links that you were using in your campaign with UTM parameters? This is the best way to ensure that you can marry campaign traffic with traffic trends in analytics.

      Joanne

      Reply
      • Harry Simmonds

        Hi Joanne, Thanks very much for your reply. No I didn’t tag the links with UTM parameters, but given that I’d had no traffic to my site until I ran the advert, I can be sure that all the traffic was a result of that. The traffic from Ashburn had a 100% bounce rate, visiting only one page and session duration was zero. What is the incentive for the bots to visit my site?

        Reply

Submit a Comment

Your email address will not be published. Required fields are marked *

Enjoyed reading this article? Find more like it below…