Spoofed and Unknown Traffic Demystified

If you check your website analytics regularly, you’ve probably seen some familiar domains in your traffic sources: google.com and facebook.com.

At first glance, this seems great.

But dig a little deeper using advanced tracking tools like LeadsLeap’s Real Visit tracking system, and you may find something strange. Your stats might look something like this:

There are no Real Visits (see arrow 1). It’s like a ghost dropped by your page without leaving a trace.

So, what’s going on?

Why would Google or Facebook send traffic that behaves like bots? Could it be fake traffic altogether?

And what about those visits that show ‘direct/unknown’ source (see arrow 2)?

Let’s break it down.

Legit Bots from Google and Facebook

First, not all bots are bad. In fact, Google and Facebook both run legitimate bots (also called crawlers or spiders) that perform useful tasks.

These bots are designed to index your link and perform validity checks.

However, this kind of traffic is usually minimal. You might see a handful of visits—not hundreds or thousands.

So, if you’re seeing a flood of bot-like traffic from these platforms, it’s likely something else.

Spoofed Referral Traffic

Understand that when a tracking system detects the ‘Referer’, it’s simply reading the HTTP header sent by the browser indicating the previous page.

This is known as Referral Spoofing.

For example, a spam bot can send a request to your site and set the referrer to google.com, even though it had nothing to do with Google.

Why Would Someone Spoof a Referral?

1) To trick you into thinking you’re getting high-quality traffic.

2) To bypass filters that block known spam sources.

How To Spot Spoofed Traffic

There is no sure way to programmatically detect spoofed traffic. (If there is, we would have done it.)

But here’s a good rule of thumb:

If you get a lot of traffic from big-name platforms with zero Real Visit, such as the example below (see arrow 1), chances are those sources are spoofed.

Unknown Traffic Sources

Now let’s talk about the traffic that shows up with unknown referral (see arrow 2 in the image above)?

Here are common reasons why a visit might show up with no referral source:

1. The visitor comes from an email, PDF, or app (like Facebook App or WhatsApp), which doesn’t send a Referer header.
2. The visitor directly enters the URL in the browser, hence no Referer header is sent.
3. The referral website blocks itself from being traced.
4. Your link is HTTP, but the referral website is HTTPS. For security reasons, HTTP cannot track HTTPS.

Whether an ‘unknown’ traffic is human or bot depends on whether it registers a Real Visit.

Is Traffic Source Any Good?

It may seem that since traffic sources can be spoofed or undetectable, they’re useless.

But that’s not the case.

In most situations, tracking systems are still able to identify the real source accurately.

In cases where source tracking fails, combining traffic data with Real Visit insights will give you a clearer picture, helping you determine whether a traffic source is genuine or spoofed.