I posted this question (Hacked or Ghost Referers) on Google groups earlier today, but I also wanted to see if the security experts here have any insight into this behavior.
I've got a web application that I'm developing locally. The server is run from a local, non-internet connected machine. The computer I access the web server is internet connected, but I simply point to the local ip address to develop the app. I'm posting here because on my Google Analytics User Flow page it shows users from Russia have accessed my site, complete with browser language setting in Russian. This wouldn't too worrying except it shows they visited multiple pages from within my site! I have no idea what is going on, whether I should be worried that there is spyware/trojans/worms or whatever running on my local machine, or if there is something weird going on with Google analytics.
Has any else experienced this issue? Should I be worried that my local machine has been compromised? Is this normal behavior for Google Analytics? How can local only traffic appear to originate from Russia, complete with browser language settings that I don't use? I have all updates and up to date antivirus.
Below is a screenshot of the users flow with urls redacted. But looking at the report it looks like Russian users have accessed multiple pages within my application.
Thanks in advance.
P.s. I only mention "Ghost Referers" because I came across this other forum post, which makes me think possibly it's related.