TrackingSpamScore

TrackingSpamScore finds automated traffic in your Matomo data and keeps it out — including bots that run a real browser with JavaScript and slip past IP-range and datacenter lists. It does not judge single requests. It looks at groups of visits: a network, a network in one country, a device profile within a network, or an IP range. A hosting network whose visits arrive suddenly, all look the same and never interact is spam. A varied crowd from a residential internet provider is not.

Everything runs on your server from data Matomo already stores: no additional JavaScript, no fingerprinting, no external service.

Reports and views

Spam networks report

Visitors › Networks & spam — one row per network (autonomous system) with visits, spam visits, spam rate, highest spam score, share of visits without events, bounce rate and average time on site. It works for every date range and segment like any other Matomo report. Tags show at a glance whether a network is blocked, allowed or a hosting network. Each row opens its visits in the visitor log; super users tick several networks and block or allow them at once.

Spam protection admin page

Administration › System › Spam protection

• Status: automatic blocking on or off, how many networks and IP ranges are blocked right now, the network database in use and the result of the last analysis.
• Detected spam sources per website: score, visits, the evidence that flagged the source, when it was last seen and until when it is blocked. Filter by minimum score and by status (blocked / not blocked); tags show whether the network is blocked by a rule or automatically, or only its IP range. Select several sources and block or allow their networks together.
• Network card: everything about one network — hosting or access network, its rule, its spam sources on all websites, its visits in the visitor log and the segment for deleting them with Matomo's GDPR tools.
• Network rules: block or allow networks, several AS numbers at once, remove selected rules — and export all rules as CSV and import them again, also on another Matomo.
• Accuracy: mark visits as bot or human in the visitor log; the page shows the precision and detection rate of your spam threshold.
• Signal weights: turn each signal off (0) or strengthen it (up to 3).
• Network database setup: if no usable network database is found, the page says why (missing, unreadable, damaged or still compressed, wrong type) and how to set one up.

Visitor log and segments

Visits with a spam score show it in the visitor log together with the reasons; super users mark them as bot or human right there. The segments spamScore (0–100) and spamAsn (network number) work in every report — for example "all visits without spam" or "only this network".

Blocking

• Networks and IP ranges you block are not tracked on any website, from the next request on.
• Automatic blocking (off by default): sources that reach the blocking threshold are blocked for 7 days; the block is extended while they keep sending spam.
• Allowing a network always wins: it is never flagged or blocked, and its spam scores are cleared with the next analysis.
• E-commerce orders are always tracked, even from blocked networks and IP ranges, so no revenue is lost.
• Blocking stops new spam. Visits that were already tracked can be deleted with Matomo's GDPR tools, using the segment shown on the network card.

How the spam classification works

1. Groups of visits

Every hour TrackingSpamScore looks at the recent traffic of each website (by default the last 24 hours) and forms groups:

The behaviour signals need a minimum number of visits per group (default 8).

2. Signals

Each signal is measured from 0 to 1 and compared with the website's own normal values, so it adapts to every site.

Primary signals can carry suspicion on their own:

Supporting signals only count together with others:

Relief:

3. From signals to a score (0–100)

• Each primary signal adds up to 50 points, each supporting signal up to 12 (all supporting signals together at most 35).
• A hosting network alone scores at most 40 — company VPNs and cloud proxies are not spam just because of where they come from.
• Corroboration: 80 or more needs two strong primary signals, or one strong primary signal plus two strong supporting signals. No single signal can turn a group into spam or get it blocked.
• Purchases then lower the score by up to 60 %.
• Your signal weights scale each signal (0 = off, 1 = default, up to 3).
• Networks you block yourself count as 100.

Example: a hosting network suddenly sends twenty times its usual traffic, and all visits last 0–2 seconds with one page view and no events: hosting network + surge + uniform behaviour → 100. A residential provider with varied visits at its normal volume gets no score at all.

4. What the score is used for

• Groups below 30 are ignored as noise.
• Each visit gets the score of its strongest group. Scores only rise; allowing a network resets them. Visits with an e-commerce order are never marked.
• Spam threshold (default 80): visits at or above it count as spam in the report, the accuracy check and the visitor log.
• Blocking threshold (default 90, at least 80): with automatic blocking on, groups at or above it are blocked during tracking.

Requirements

• Matomo 5 (5.0 or newer, below 6.0), PHP 8.1 or newer.

• Matomo's scheduled tasks must run (cron with core:archive, or browser-triggered archiving) — the analysis runs every hour.

• A network (ASN) database in Matomo's GeoIP directory, which you install and keep up to date yourself:

  • DB-IP IP to ASN Lite — free, no account, CC BY 4.0; Matomo's automatic geolocation updates can download it every month.
  • MaxMind GeoLite2-ASN — free with a MaxMind account.

  The database is not included with the plugin. Without one, only IP ranges are evaluated.

• Recommended: GeoIp2 as location provider (countries).

Getting started

1. Install and activate the plugin and set up the network database — the admin page guides you.
2. Leave automatic blocking off for a few days and look at the spam networks report and the detected sources.
3. Block obvious hosting networks yourself, several at once if you like.
4. Mark some visits as bot or human in the visitor log and check precision and detection rate.
5. Turn on automatic blocking once the accuracy looks right.

Settings

Administration › System › General settings › FeinwerkTrackingSpamScore

Privacy

All signals come from data Matomo already stores: network and country from the IP address, visit duration, actions, events, referrer type, browser and device. No additional data is collected and nothing leaves your server. Spam that was already tracked is deleted with Matomo's GDPR tools.

License

Commercial plugin under the Feinwerk EULA.