TrackingSpamScore

Overview

TrackingSpamScore finds automated traffic in your Matomo data and keeps it out, including bots that run a real browser with JavaScript and slip past IP-range and datacenter lists. It does not judge single requests. It looks at groups of visits: a network, a network in one country, a device profile within a network, or an IP range. A hosting network whose visits arrive suddenly, all look the same and never interact is spam. A varied crowd from a residential internet provider is not.

Everything runs on your server from data Matomo already stores: no additional JavaScript, no fingerprinting, no external service.

Reports and views

Spam overview

Visitors › Networks & spam starts with the spam overview: spam visits, their share of all visits and the number of spam networks over time, as an evolution graph and as sparklines with the change against the previous period. Both are also available as dashboard widgets.

Spam networks report

One row per network (autonomous system) with visits, spam visits, spam rate, highest spam score, share of visits without events, bounce rate and average time on site. It works for every date range and segment like any other Matomo report. Tags show at a glance whether a network is blocked, allowed or a hosting network.

• IP ranges: expand a network to see its IPv4 /24 and IPv6 /48 ranges, each with its own figures and visits, and block a single range right there with one click.
• Goals view: conversions, conversion rate and revenue per network, e-commerce included: does traffic from a network ever buy anything?
• Filter: show all networks, only blocked or not blocked ones, or hosting networks only; the choice is remembered per user, and Select all ticks the whole list for super users.
• Act in place: each row opens its visits in the visitor log; super users open a network's details in a popover and block or allow it without leaving the report, or tick several networks and block or allow them at once.

Spam protection admin page

Administration › System › Spam protection

• Status: automatic blocking on or off, how many networks and IP ranges are blocked right now, the network database in use, the result of the last analysis and the websites with limited blocking.
• Detected spam sources per website: score, visits, the evidence that flagged the source, when it was last seen and until when it is blocked. Filter by minimum score and by status (blocked / not blocked); tags show whether the network is blocked by a rule or automatically, or only its IP range. Select several sources and block or allow their networks together.
• Network card: everything about one network: hosting or access network, its rule, its spam sources on all websites and its visits in the visitor log. With the Delete Visits Filter plugin you also delete its already tracked visits right there: choose this or all websites and the last 7 to 365 days, count them, confirm.
• Network and IP range rules: block or allow networks or single IP ranges (any CIDR range), several at once, remove selected rules, and export all rules as CSV and import them again, also on another Matomo.
• Accuracy: mark visits as bot or human in the visitor log; the page shows the precision and detection rate of your spam threshold.
• Signal weights: turn each signal off (0) or strengthen it (up to 3).
• Network database setup: if no usable network database is found, the page says why (missing, unreadable, damaged or still compressed, wrong type) and how to set one up.

Visitor log and segments

Visits with a spam score show it in the visitor log together with the reasons; super users mark them as bot or human right there. The visitor profile shows how many of a visitor's visits were spam. The segments spamScore (0 to 100), spamAsn (network number, with suggestions in the segment editor) and spamMark (visits marked as bot or human) work in every report, for example "all visits without spam" or "only this network".

Email about new spam networks

Each user can turn it on in their personal settings: at most once a day, an email lists the networks that reached the spam threshold on their websites for the first time in 30 days, with their visits and a link to the report.

Blocking

• Networks and IP ranges you block are not tracked on any website, from the next request on.
• Automatic blocking (off by default): sources that reach the blocking threshold are blocked for 7 days; the block is extended while they keep sending spam.
• Allowing a network always wins: it is never flagged or blocked, and its spam scores are cleared with the next analysis.
• E-commerce orders are always tracked, even from blocked networks and IP ranges, so no revenue is lost.
• IP ranges instead of whole networks: block or allow any IP range, e.g. 203.0.113.0/24 or 2001:db8::/48. Range rules take precedence over network rules: an allowed range (your office or uptime monitor inside a cloud network) is never blocked or marked as spam, a blocked range is blocked even inside an allowed network.
• Per website: in the website settings, super users choose whether a website applies all rules (default), only your own block rules, or never blocks and only monitors.
• Blocking stops new spam. Visits that were already tracked are deleted from the network card with the Delete Visits Filter plugin, or with Matomo's GDPR tools using the network's segment.

How the spam classification works

1. Groups of visits

Every hour TrackingSpamScore looks at the recent traffic of each website (by default the last 24 hours) and forms groups:

Group	Example
Whole network	all visits from one autonomous system
Network in one country	visits from that network located in one country
Device profile in a network	same browser version, operating system and screen size within one network
IP range	IPv4 /24 or IPv6 /48, used when Matomo's IP anonymisation masks at most one byte

The behaviour signals need a minimum number of visits per group (default 8).

2. Signals

Each signal is measured from 0 to 1 and compared with the website's own normal values, so it adapts to every site.

Primary signals can carry suspicion on their own:

Signal	What it measures
Hosting network	The network belongs to a hosting or cloud provider: a built-in list, the organisations blocked in Matomo's TrackingSpamPrevention and your own block rules.
Sudden traffic surge	Visits in the window against the group's daily median of the last 28 days. It counts from twice the usual volume and is at full strength at six times. Networks that are normally absent count as sudden. Needs three days of history.
Uniform behaviour	How little visit duration and number of actions vary within the group. People differ, scripts repeat.

Supporting signals only count together with others:

Signal	What it measures
Repeated page loads	The same page is loaded again and again within visits.
Unusual country	A country that normally brings less than 1 % of the website's traffic suddenly surges.
No interactions	No events, although the website's visitors usually trigger some (only if at least 5 % of its visits do).
No campaign traffic	No campaign visits, although the website usually receives some (only if at least 5 % of its visits are campaign visits).
Outdated or automated client	Typical bot screen sizes (800×600, 1024×768, 0×0, 1×1) or a browser more than two major versions behind the newest one seen.

Relief:

Signal	Effect
Purchases	E-commerce orders from the group compared with the website's average. At the average rate the score drops by 60 %; a single order among thousands of bot visits hardly changes it.

3. From signals to a score (0 to 100)

• Each primary signal adds up to 50 points, each supporting signal up to 12 (all supporting signals together at most 35).
• A hosting network alone scores at most 40: company VPNs and cloud proxies are not spam just because of where they come from.
• Corroboration: 80 or more needs two strong primary signals, or one strong primary signal plus two strong supporting signals. No single signal can turn a group into spam or get it blocked.
• Purchases then lower the score by up to 60 %.
• Your signal weights scale each signal (0 = off, 1 = default, up to 3).
• Networks you block yourself count as 100.

Example: a hosting network suddenly sends twenty times its usual traffic, and all visits last 0 to 2 seconds with one page view and no events: hosting network + surge + uniform behaviour → 100. A residential provider with varied visits at its normal volume gets no score at all.

4. What the score is used for

• Groups below 30 are ignored as noise.
• Each visit gets the score of its strongest group. Scores only rise; allowing a network resets them. Visits with an e-commerce order are never marked.
• Spam threshold (default 80): visits at or above it count as spam in the report, the accuracy check and the visitor log.
• Blocking threshold (default 90, at least 80): with automatic blocking on, groups at or above it are blocked during tracking.

For administrators

• Activity log: with Matomo's ActivityLog plugin, rule changes and imports, signal weights and bot/human marks are recorded with user and time.
• Diagnostics: Matomo's system check shows whether the hourly analysis runs on time, how old the network database is and the license status.
• API: spam overview, spam networks with their IP ranges, detected spam sources (also as CSV), status and network rules.
• Large instances: the analysis time per run and the row limits of the spam networks report can be raised in config.ini.

Requirements

• Matomo 5 (5.0 or newer, below 6.0), PHP 8.1 or newer.

• Matomo's scheduled tasks must run (cron with core:archive, or browser-triggered archiving); the analysis runs every hour.

• A network (ASN) database in Matomo's GeoIP directory, which you install and keep up to date yourself:

  • DB-IP IP to ASN Lite: free, no account, CC BY 4.0; Matomo's automatic geolocation updates can download it every month.
  • MaxMind GeoLite2-ASN: free with a MaxMind account.

  The database is not included with the plugin. Without one, only IP ranges are evaluated.

• Recommended: GeoIp2 as location provider (countries).

Getting started

1. Install and activate the plugin and set up the network database; the admin page guides you.
2. Leave automatic blocking off for a few days and look at the spam networks report and the detected sources.
3. Block obvious hosting networks yourself, several at once if you like.
4. Mark some visits as bot or human in the visitor log and check precision and detection rate.
5. Turn on automatic blocking once the accuracy looks right.

Settings

Administration › System › General settings › FeinwerkTrackingSpamScore

Setting	Default	Purpose
Block detected spam networks automatically	off	Blocks networks and IP ranges at or above the blocking threshold for 7 days. Your own rules always apply.
Spam threshold	80	Score (30 to 100) from which visits count as spam.
Blocking threshold	90	Score (80 to 100) needed for automatic blocking.
Analysis window	24 hours	Recent traffic the hourly analysis looks at.
Minimum group size	8	Visits a group needs before it is evaluated.

Per website (Administration › Websites › Manage, super users): Spam protection: blocking on this website. Per user (Personal › Settings): Email me about new spam networks.

Privacy

All signals come from data Matomo already stores: network and country from the IP address, visit duration, actions, events, referrer type, browser and device. No additional data is collected and nothing leaves your server. Tracked visits are only deleted when you start it yourself, after counting and confirming.

License

Commercial plugin under the Feinwerk EULA.

Use cases

• Catches bots with real browsers: Headless browsers that run JavaScript get past IP-range filters. TrackingSpamScore judges whole groups: sudden, uniform traffic from a hosting network that never interacts stands out, even when each single visit looks normal.
• Clean numbers from now on: Block whole networks or just single IP ranges during tracking: one by one, several at once, or automatically for 7 days once a source reaches the blocking threshold. E-commerce orders always get through.
• Every decision explained: Each spam source lists the evidence that flagged it, and the visitor log shows score and reasons per visit. Mark visits as bot or human and see precision and detection rate.
• Built for busy instances: An hourly background analysis on grouped statistics and paged lists that load fast. Everything runs inside your Matomo: no extra JavaScript, no external service.

Step-by-step setup

Installation and activation are covered in Installing plugins. The following steps need super user access.

1. Provide the network (ASN) database

The plugin recognises networks (autonomous systems such as internet providers, hosting and cloud companies) from an ASN database in Matomo's GeoIP folder, usually misc/. It is not included: you obtain it, use it under its own licence terms and update it monthly:

• DB-IP IP to ASN Lite (free, no account, CC BY 4.0 licence, recommended): open Administration → System → Geolocation and use Setup automatic updates of geolocation databases. In ISP Database, enter the download address shown on the Spam protection page (pattern: https://download.db-ip.com/free/dbip-asn-lite-YYYY-MM.mmdb.gz). Matomo stores it as DBIP-ASN.mmdb and refreshes it monthly. If the field is greyed out, Matomo requires its bundled Provider plugin for it. Or download it from db-ip.com and place it unpacked as dbip-asn-lite-YYYY-MM.mmdb.
• MaxMind GeoLite2-ASN (free MaxMind account required): place GeoLite2-ASN.mmdb unpacked in the folder, readable for the web server.

If both are present, the plugin uses GeoLite2-ASN. With DB-IP it credits the data source on the admin page and in the report, as its licence asks. Without a database, only IP ranges are evaluated.

2. Check the status

Open Administration → System → Spam protection. It shows the network database in use, whether automatic blocking is on, what is blocked right now and the last analysis result. If no usable database is found, the section Set up the network database explains why. The same check appears under Administration → Diagnostic → System Check.

3. Keep scheduled tasks running

The analysis runs every hour with Matomo's scheduled tasks, i.e. by cron with core:archive or through browser-triggered archiving. GeoIp2 as location provider is recommended, so the analysis knows countries.

4. Choose your settings

Under Administration → System → General settings → FeinwerkTrackingSpamScore (linked from the admin page via Change settings):

• Block detected spam networks automatically: leave it off until the detections look right to you.
• Spam threshold (default 80, allowed 30 to 100): from this score a visit counts as spam.
• Blocking threshold (default 90, allowed 80 to 100): the score at which automatic blocking applies.
• Analysis window (hours) (default 24, allowed 1 to 168): how much recent traffic the analysis looks at.
• Minimum group size (default 8, allowed 3 to 100): visits a group needs before it is evaluated.

Per website, under Administration → Websites → Manage, the setting Spam protection: blocking on this website decides whether a website applies all rules (default), only your own block rules, or never blocks and only monitors. Scores and reports stay the same in every mode.

5. Block or allow networks and IP ranges

The report is under Visitors → Networks & spam → Spam networks. The row action Manage network opens the network card with Block network, Allow network and Remove rule. Above the report, Show limits it to blocked, not blocked or hosting networks (remembered for you). For several networks, tick them in the report (Select all ticks the whole list) or under Detected spam sources and click Block selected or Allow selected. Under Network rules → Add rule, enter one or more AS numbers or IP ranges in AS numbers or IP ranges and choose Block or Allow. Rules apply immediately and to all websites.

If a whole network is too much, block or allow single IP ranges in CIDR notation, e.g. 203.0.113.0/24 or 2001:db8::/48 (a single address counts as /32 or /128; ranges need at least /8 or /16). Expand a network in the report and click the lock next to one of its IP ranges, or use the lock at an IP-range source under Detected spam sources. Range rules have their own list under IP range rules, and the network card shows the range rules of its network and adds new ones. They take precedence over network rules: an allowed range is never blocked or marked as spam, a blocked range is blocked even inside an allowed network and its visits count as spam, and if two range rules overlap, allowing wins. A network rule you allow still wins over automatic blocks.

Practical examples

Twice the visits overnight. A hosting network tops the report with a high Spam rate, many visits Without events and short visits. The network card lists evidence such as "Sudden traffic surge" and "Uniform behaviour". You click Block network. To delete the visits already tracked, install the free DeleteVisitsFilter: the network card then offers Delete tracked visits, where you choose this or all websites and the last 7 to 365 days, click Count visits and confirm; the deletion runs in the background. Without it, use Administration → Privacy → GDPR Tools with the segment from the card, e.g. spamAsn==64500.

Start carefully. Automatic blocking stays off for a few days. A link under Accuracy opens all visits at or above the spam threshold in the Visits Log, where you mark samples as Bot or Human. Once Precision and Detection rate look right, you turn blocking on.

Your own service shows up. An uptime monitor or the company VPN runs through a cloud network and appears under Detected spam sources. You allow just its IP range, e.g. 198.51.100.0/26, under Network rules → Add rule. The range is never blocked, even if you block the rest of that cloud network.

Only part of a network sends spam. A large provider's network shows spam from one /24 range while the rest are real visitors. Expand the network in the report and block just that range with the lock next to it.

Good to know

• Stored data: per visit the network number and, from a score of 30, the spam score; plus detected sources with evidence, your rules, marks, signal weights and daily grouped figures as a baseline. All of it stays in your Matomo database.
• Timing: scores arrive up to one hour after a visit. With the database in place, new visits get their network at once, those of the last four weeks in the next runs. Surge detection needs three days of history.
• How scores evolve: each group is measured against your own website's normal values, surges against its daily median of the last 28 days. A visit takes the score of its strongest group; scores only rise, and allowing a network resets them. No single signal reaches 80. Signal weights turn signals off (0) or up (to 3).
• Blocking: automatic blocks last 7 days after the source last reached the blocking threshold; removing your own rule unblocks at once. Own IP range rules take precedence over network rules. Blocking deletes nothing. E-commerce orders are always tracked, and visits with an order never count as spam.
• IP ranges: evaluated only where Matomo keeps them after IP anonymisation (with two masked bytes only IPv6 /48 ranges). Networks are always recognised, because the plugin determines them during tracking, before anonymisation.
• Permissions: the admin page, settings, rules and marks are for super users. Everyone with view access to a website sees the report.
• Troubleshooting: analysis not run yet? Check cron and scheduled tasks. Report says no usable network database is installed? See step 1. Problems of the last analysis appear on the admin page; more in Troubleshooting.

Technical reference

Property	Value
Technical name	FeinwerkTrackingSpamScore
Current version	0.12.1
Matomo	≥ 5.0.0, < 6.0.0
PHP	≥ 8.1.0
License	paid
Database changes	none in the current version

FAQ

Does it delete my data?

Not on its own. It marks visits with a spam score that you can filter by segment, and blocking only affects new tracking requests. To remove spam that was already tracked, you count and confirm the deletion on the network card (with the Delete Visits Filter plugin) or use the segment with Matomo's GDPR tools.

Can I block only part of a network?

Yes. Expand the network in the spam networks report and block a single IP range, or enter any range in CIDR notation as a rule. Allowed ranges work the other way round: your office or monitoring service inside a cloud network stays trackable even if you block the rest of that network.

Can a website be left out of blocking?

Yes. In the website settings, super users choose per website: all rules (default), only your own block rules, or never block and only monitor. Scores and reports stay the same in every mode.

Can it block real visitors?

Automatic blocking is off until you turn it on. It needs several corroborating signals, lasts 7 days and never applies to networks you allowed. A hosting network alone never becomes spam, and e-commerce orders are always tracked.

Which network database do I need?

DB-IP IP to ASN Lite (free, no account, Matomo can update it automatically) or MaxMind GeoLite2-ASN (free with a MaxMind account). The admin page checks the database and explains how to set it up. Without one, only IP ranges are evaluated.

Does it slow down tracking?

Each tracking request is checked against a cached block list and the network database, a quick lookup. The analysis runs once an hour in the background on grouped statistics.

How is it different from Matomo's TrackingSpamPrevention?

TrackingSpamPrevention blocks fixed lists such as cloud IP ranges and organisation names. TrackingSpamScore learns from behaviour and also catches networks no list knows yet; it uses TrackingSpamPrevention's organisation list as one of its inputs. Both work together.

Can I take my rules to another Matomo?

Yes. Export all rules as a CSV file and import it there. The import also accepts any CSV with the columns asn and rule, or a plain list of AS numbers, which are then blocked.