0

I posted this question (Hacked or Ghost Referers) on Google groups earlier today, but I also wanted to see if the security experts here have any insight into this behavior.

I've got a web application that I'm developing locally. The server is run from a local, non-internet connected machine. The computer I access the web server is internet connected, but I simply point to the local ip address to develop the app. I'm posting here because on my Google Analytics User Flow page it shows users from Russia have accessed my site, complete with browser language setting in Russian. This wouldn't too worrying except it shows they visited multiple pages from within my site! I have no idea what is going on, whether I should be worried that there is spyware/trojans/worms or whatever running on my local machine, or if there is something weird going on with Google analytics.

Has any else experienced this issue? Should I be worried that my local machine has been compromised? Is this normal behavior for Google Analytics? How can local only traffic appear to originate from Russia, complete with browser language settings that I don't use? I have all updates and up to date antivirus.

Below is a screenshot of the users flow with urls redacted. But looking at the report it looks like Russian users have accessed multiple pages within my application.

GA User Flow with Russian Site Traffic

Thanks in advance.

P.s. I only mention "Ghost Referers" because I came across this other forum post, which makes me think possibly it's related.

Improve this question
4
  • If it is not connected to the Internet, how is it uploading data to Google Analytics?
    – schroeder ♦
    Feb 14, 2015 at 0:59
  • GA is sent browser side via a tracking code in the front end. The analytics don't come from the server.
    – James
    Feb 14, 2015 at 2:42
  • Then it would seem that Russian malware on your machine is unlikely because it would still show as coming from your machine. What country are you in? Could your ISP be interpreted as Russian?
    – schroeder ♦
    Feb 14, 2015 at 5:49
  • Doubtful that my ISP should be interpreted as originating from Russia (I'm in the states). But even if something weird like that happened, other metrics show the browser language to be in Russian as well!
    – James
    Feb 14, 2015 at 9:41

2 Answers 2

Reset to default
1

Either your web server is internet-accessible somehow or these are bogus-requests; you should check the access logs on your web server, if it doesn't show up there, then it's an issue with GA.

BTW, we have some servers in a datacenter in $someplace in western europe that shows up on GeoIP-matches as russian IPs, which gave us a huge "YIKES!!!!!!!! SSH-Access from Russia to our servers?" bump. If possible you should check the IPs behind the GA events and where they originate from. Robtex.com might be handy when analyzing IPs.

Improve this answer
1
  • Thanks for your answer. I'm new to GA, so I'm not sure if you can see the originating IPs via GA. If this were a live webserver, then yes, I could check the logs. I think your first suggestion is likely the correct answer. See my answer for more details. Thank you.
    – James
    Feb 15, 2015 at 6:43
0

As I stated in my question, my site is developed locally. Thus, no one (other than me and Google) has access to the key used to identify my site traffic. This is why I was initially very concerned that perhaps my local machine had been compromised. Seeing traffic like that is alarming under these circumstances.

But, after feedback from here and the Google groups forum, I think this is a ghost referer problem. It appears that people are able to either acquire or spoof the tracking codes that identify website traffic for Google Analytics. On the User Flow page you can highlight how the traffic flowed through your site from various sources. By doing this, I can see that all the referrals from Russia hit the non-existent site root and subsequently drop off. That is, they did not access my internal pages as it first appears in chart without the filter. Below is a screenshot.

User Flow with filter, spoofed analytics drop off.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .