It’s time to check your Google Analytics for Amazon Bot Spam

UPDATE: As of 4th February 2020, the ‘Network Domain’ and ‘Service Provider’ dimensions in Google Analytics have been marked as ‘no longer supported’ and are returning (not set) values – so filtering bot traffic just got a little bit tougher and some of the recommendations below may no longer be applicable.

Bot Spam traffic in Google Analytics has EXPLODED in the last few years. We’re seeing it all the time in our clients’ accounts. More and more we’re seeing this bot traffic attributed to Amazon.

In fact, I was inspired to write this blog after a query from one of our clients:

“Why is there over a 30% difference in total users from our filtered GA view to our unfiltered view. I can’t believe it’s all spam”– said Client X.
It turns out the answer was spam and most of it was attributed to Amazon.

So, sit back, relax and prepare yourself to learn all about Amazon bot spam, how we find it and what we do about it.

Should I Worry About Bot Traffic in Google Analytics?

The short answer is: Yes. The longer answer is: Definitely. Yes. 100%. Why are you even asking? Are you serious?

We need to filter out bad bots from Google Analytics so that we can be confident that the data we report on (the traffic totals, behavioural insights and conversion rates etc) are really from human beings, not bots. Our clients are data-driven organisations, so the data that is driving their decisions MUST BE accurate.

How did we Find this Spam?

Some things we look for when trying to identify bot traffic in client accounts are:

• Low site engagement
• High bounce rates
• No goal completion

When you see all the above things, you might just have found yourself some spam!

How to Check Your Google Analytics Account

In Analytics, navigate to Audience > Technology > Network.

Add a table filter on Service Provider with a substantial amount of sessions (say 200+) and bounce rates higher than 90%.

Ahhh, here we see the usual suspect…Amazon. In this example, we have multiple variations of “traffic” from Amazon including “amazon technologies inc”, “amazon.com inc” and “amazon data services uk”.

Let’s look at the evidence. The “traffic” from these have some things in common: have very high bounce rates, low pages/session and average session duration of just 1 second or below. Looks suspicious, right? It’s because it is.

Want more proof? Add “City” as the secondary dimension, and you will find that this “traffic” often comes from either Ashburn or Boardman – exactly where Amazon’s data centres are located.

Don’t do a lot of business in Ashburn or Boardman? No? Neither does this client but as you can see, this client is getting a substantial amount of low-quality traffic from “Amazon”. But now – it’s not really from Amazon, is it?

How Did we Deal with this Amazon Bot Traffic?

1.    Enable Bot Filtering

Go to Admin > View Setting and tick the box to filter out “known” bots and spiders. This filter excludes all known bots/spiders listed by the Interactive Advertising Bureau. It provides some degree of protection but won’t fully protect your site against all bots and spam traffic. Still, it’s a good way to start protecting your site from known bots and spiders.

TOP TIP! Don’t enable this on your main reporting View. Create a Test View first, so that you can see what data is being excluded. It’s best practice to run tests on all filters including filters from Google.

2. Set up an ISP Domain Filter

Remember our screenshot above where we found that there was a substantial amount of suspicious traffic from “amazon technologies inc”, “amazon.com inc” and “amazon data services uk”?  Add Network Domain as the secondary dimension and you’ll see that the Network Domain for this traffic is “amazonaws.com”.

Using this data, we recommend creating an ISP Domain filter to filter out this traffic. This is what it looks like:

Don’t forget to verify your filter to make sure it will work!

And there you have it, how to find and how to exclude bot traffic from Amazon!

What are your thoughts on spam traffic in Google Analytics? What precautionary measures do you take? Happy to hear your comments!

27 responses to “It’s time to check your Google Analytics for Amazon Bot Spam”

1. Maureen says:

   September 9, 2019 at 10:08 am

   Thanks for this info. Really insightful. While this will help with GA, the reason I checked your info is that I’m seeing an abnormal rhythm of spikes in Amazon reporting itself, that is not converting to sales – numbers go up 50 or so every 3 days. 2 days near zero, then next day 50 higher than the other 50. Any way I can deal with this? or shouldn’t I worry about it. Thank you!

   Reply
   • Nicola Bell says:

     September 10, 2019 at 6:29 pm

     Hi Maureen, thanks for the comment. We specialise in Google Analytics and why some analytics accounts may see increased bot traffic from Amazon. I think you’re talking about Amazon analytics, unfortunately, this wouldn’t be our area of expertise. Sorry, we can’t be more help!

     Reply
2. Crypto news says:

   September 21, 2019 at 6:30 am

   Hello,
   Thanks for this article. I was also facing the same problem. My SMO service provided 1500 traffic in one day. I thought it is suspicious and checked and by reading this blog I got confirmed that it is bot traffic. Thanks for this update. However, there is a question I added isp domain as a filter but traffic didn’t remove yet. Please let me know the reason.

   Reply
   • Michael Wilson says:

     September 23, 2019 at 6:31 pm

     Any filters you add in Google Analytics will only work from the time they’re created – it is not possible to filter historical data, unfortunately…

     Reply
3. Allie Williams says:

   September 30, 2019 at 11:15 pm

   Hello, do you ever see legitimate traffic from the amazonaws.com Network Domain?

   While I’m seeing the high bounce rates/low session duration for the majority of sessions from this ISP, I also see some sessions from “amazon corporate llc” and “amazon data services canada” where the bounce rate is 35-60% and the session duration is much longer (tens of seconds to minutes).

   Thanks!

   Reply
   • Michael Wilson says:

     October 2, 2019 at 6:32 pm

     Hi Allie,

     Anytime we’ve checked for amazonaws.com as the network domain, it’s looked pretty clearly like bot traffic. I don’t know for certain if all traffic from that network domain is always bot traffic though so that’s why it’s a good idea to check the engagement metrics as well.

     It is important to check a range of network domains, service providers, cities and so on in your Google Analytics data in order to work out the best approach to filter out as much bot traffic as possible for your specific scenario.

     There is always the risk of filtering out some real users but sometimes it’s for the greater good if you can clean out thousands of bot sessions, even if you lose a handful of legit sessions in the process.

     Reply
4. Charles says:

   October 18, 2019 at 10:35 pm

   Thanks for this great article. Very insightful.
   My concern is not only cleaning GA report, it is more how to stop those bots surcharging my site.
   It is bad for performance and could also cost a lot of money.

   Reply
5. Hayden says:

   October 22, 2019 at 3:51 am

   Great article!I appreciate the insight on the the amazon bot traffic as I have been getting a ton of referral traffic from my commodity domain names out of the Ashburn amazon data center. What exactly are the purpose or goals of these amazon bots?
   Thanks!
   Hayden

   Reply
6. Luke says:

   October 25, 2019 at 7:20 pm

   Hi there, I have implemented this as this is the exact thing I was seeing in my analytics account. Filter verification is where I am hitting a snag.

   Essentially, after the verification runs my “before filter applied” data looks fine but the “after filer applied” data shows nothing. Not even zeros.

   Any ideas as to why? I created a test view just in case it is working but I noticed this when I was curious what trying to verify it on the live view would look like.

   Thanks for the great resource!

   Reply
   • Michael Wilson says:

     October 30, 2019 at 6:33 pm

     Hi Luke,

     Your ‘after filter applied’ data shows nothing because the data is being filtered out. 🙂

     That’s how it’s supposed to look, don’t worry!

     Reply
7. Bobbi says:

   November 20, 2019 at 2:45 pm

   I’ve got what looks like it could be bot traffic, however when I look under Technology>Network it shows Pinterest and the network domain is pinterest.com but it’s coming through as direct traffic and is all out of ashburn.

   Reply
8. Lautaro says:

   December 12, 2019 at 4:05 pm

   Hello! I’m having a similar issue with a difference: most of the e-Commerce transactions come from this city. The e-Commerce conversion rate adds up to 160%.
   The transactions in Analytics is equal to the transactions in the e-commerce platform (only that in the e-commerce platform not even one transaction come from Ashburn).

   I’m thinking that this could be some kind of redirect of the payment gateway, but I can’t figure out how to solve it.

   Can you help me out?

   Reply
   • Joanne Kearney says:

     April 20, 2020 at 6:36 pm

     Hi Lautaro,

     Apologies- we missed replying to your comment! Can you let us know what payment provider you use? You might need to edit your property settings depending on this.

     Thanks,

     Joanne

     Reply
9. Katie Rosenbaum says:

   December 27, 2019 at 4:30 pm

   Hi,

   I was recently told by our phone provider that they use “AmazonAWS” to push data through. They asked us to unblock the IPS AWS so that their data could come through, but I’m not sure I trust that. Have you ever heard of this before? Thank you.

   Reply
   • Michael Wilson says:

     January 2, 2020 at 6:34 pm

     Hi Katie,

     Hard to say without more info – i.e. what data are they trying to push through – but Amazon Web Services is a cloud platform so it could well be used for a legit purpose.

     Michael

     Reply
10. Kamal says:

    January 14, 2020 at 9:17 am

    I am getting such traffic from a long time but I dont see high bounce rate with this traffic. Bounce rate is 10% while pages per visit are also more. Though there are no link clicks but multiple pages visited per visit. It shows 300,271 sessions from amazonaws.com and 10.32% bounce rate and 15.11 pages/session.

    Is it still a bot traffic?

    Reply
    • Joanne Kearney says:

      April 20, 2020 at 6:37 pm

      Hi Kamal,

      When you segment this traffic (you can do this through building an advanced segment) are there significant peaks and dips in traffic or is the pattern of traffic flat?

      Joanne

      Reply
11. Robert says:

    February 7, 2020 at 4:49 am

    I will provide a different view on things regarding the AWS traffic bot spam…

    The quick backstory: In July 2017, I was spam e-mail bombed in my general, everyday Gmail account. I was thrust in to the world of learning about spam e-mail, DDoS, DoS, i. p. adresses, hosts, Registrars, etc. I fought a two and a half year battle to save my e-mail address. There however, was the nagging AWS spam from one host that AWS blatantly ignored, after that two and a half year battle.

    Just last week, out of being fed up, I contacted AWS’ Registrar Mark Monitor’s Abuse Department. Mark Monitor responded back saying I need to contact hostmaster@amazonaws.com. I sent two abuse complaints with headers to the Host Master and the spam e-mails from the infected host (no doubt it was a bot, as I too in my research came up with Ashburn, VA Data Center) stopped!

    So, if yourselves are having issues with filtering out the crawl bots, you could always e-mail hostmaster@amazonaws.com with your complaints, since e-mailing abuse@amazon.com and abuse@amazonaws.com is worthless.

    Reply
12. Harry says:

    April 10, 2020 at 12:53 pm

    Thank you for a very helpful article. I’ve just received lots of hits from Ashburn after running a Pintrest pay-per-click campaign for my business. I’m a complete beginner to this so forgive my ignorance, but is this Pintrest trying to make more money from me by using fake clicks? What is the incentive for bots to visit my site otherwise?

    Reply
13. Harry says:

    April 10, 2020 at 8:26 pm

    Perhaps you wont be able to publish my last post because I specified Pintrest so I have re-worded it below:

    Thank you for a very helpful article. I’ve just received lots of hits from Ashburn after running a Social Media pay-per-click campaign for my business. I’m a complete beginner to this so forgive my ignorance, but is the social media company trying to make more money from me by using fake clicks? What is the incentive for bots to visit my site otherwise?

    Reply
    • Joanne Kearney says:

      April 14, 2020 at 6:40 pm

      Hi Harry,

      Have you looked at the traffic to see the pattern of activity from Ashburn? Is it low average duration/page per visit/high bounce rate/peaks on certain days? We can’t say that it is 100% bot traffic but the likelihood is that it is- if it is from Ashburn and it has stood out enough to make you comment here!

      It is unlikely though, that this traffic that has been generated as a direct result from clicks that have been made on your ad that would have cost you more money. Normally ad platforms are good at filtering out invalid clicks (coming from irregular patterns in clicks from certain IPs). Did you tag the links that you were using in your campaign with UTM parameters? This is the best way to ensure that you can marry campaign traffic with traffic trends in analytics.

      Joanne

      Reply
    • Harry Simmonds says:

      April 14, 2020 at 8:41 pm

      Hi Joanne, Thanks very much for your reply. No I didn’t tag the links with UTM parameters, but given that I’d had no traffic to my site until I ran the advert, I can be sure that all the traffic was a result of that. The traffic from Ashburn had a 100% bounce rate, visiting only one page and session duration was zero. What is the incentive for the bots to visit my site?

      Reply
14. Mahruf Ahmed says:

    October 21, 2020 at 11:49 pm

    hi, I am receiving a lot of peaks in direct traffic recently with 100% bounce rate and 0 session duration and 0 pages/session. The landing page name in google analytics includes the term s’pr_prod_strat=copurchase&pr_rec_pid’ in them. Almost all of this traffic comes from Oregon in the USA while sometimes from it comes from Canada or UAE. Doing some research on the mentioned term in landing page links, I’ve come across people talking about scam shops. What’s more alarming is I notice a drop in my traffic a day or two following this suspicious traffic. Can you please enlighten me with your thoughts regarding this? Thanks

    Reply
    • Michael Wilson says:

      October 27, 2020 at 6:42 pm

      Hi Mahruf,

      Definitely sounds like spam traffic so I’d advise filtering it out or blocking those visits if you can.

      I’m not sure if or how it could be responsible for a drop in traffic in the days afterwards though, that’s not something I’ve heard of before.

      Michael

      Reply
15. Zka says:

    March 3, 2021 at 9:24 am

    It’s not 100% spam traffic, I’ve had a legitimate customer through compute.amazonaws.com host… Now I’m not sure how to filter this, since about 100% of that domain is bot spam. Not identifying the crawler by the browser string is really worth a paddling.

    Reply
16. ehab says:

    July 8, 2021 at 2:05 pm

    in the past i used the tools in WebTrafficSeo.com to avoid bots traffic .

    Reply
17. Barb says:

    July 20, 2021 at 10:06 pm

    To my surprise last week, we switched anti-virus programs, I ran a scan and it showed Amazon Technolgies IP address (Ohio) in my LinkedIn account. I opted to close all connected windows and send them a little message.

    Reply