I run a referral beacon on my own site. It records one thing per visit, the referrer host and the path, and it only fires after the browser has parsed the document and run an effect. That was meant to make it a count of people rather than a count of requests.
Between 2026-08-31 and 2026-09-14 it recorded 59 browser-confirmed visits referred by google.com.
Google Search Console recorded 1 for the same dates.
| source | visits from google.com |
|---|---|
| my beacon, browser-confirmed | 59 |
| Search Console, every search type | 1 |
Search Console is Google's own log of the clicks Google sent. I queried it per search type so I couldn't flatter myself by leaving one out: web 1, discover 0, googleNews 0, news 0, image 0, video 0. Google can't send 59 visits and report 1, so 98.3% of the one referrer I can independently check is not a person.
The part that should worry you
The same beacon says 111 of my visits came from AI engines: chatgpt.com (48), bing.com (35), cn.bing.com (9), copilot.microsoft.com (9). Same code, same visitors, same weeks as the google.com number that turned out to be 98.3% wrong.
There is no Search Console for ChatGPT. I can't check that number, and if you're watching an AI referral line climb in your analytics, you probably can't check yours either. I'm not publishing mine as traffic.
DataDome's Galileo threat research team wrote up the mechanism on 2026-02-05. Scrapers set 'Referer': 'https://chatgpt.com/' because analytics accepts the header without checking it, and security tools go easy on traffic claiming to come from a reputable domain. They saw it from inside a bot defence network on big sites. I'm showing it from the other end, on a site small enough that the true number is knowable.
The smell that sent me looking
My site ranks business software. 45 beacon fires, 6.5% of the total, carry a referrer no public browser can produce: loopback, private LAN ranges and bare machine names.
localhost 21
127.0.0.1 10
192.168.1.42 2
172.16.2.1 2
192.168.100.77 2
72.61.244.214 1
172.33.0.9 1
172.13.10.5 1
dwprod 1
10.10.50.169 1
192.168.10.9 1
aaes-cms 1
172.18.170.153 1
Another 132, 19.1%, came from streaming, gaming, adult and consumer retail. A finance buyer does not arrive at a cap table comparison from Netflix.
The first group isn't a judgement call. The second one is, which is why I list the hosts and never add the two into a single "fake" number.
Two rebuilds I threw away first
The first version trusted the Referer header. That lasted a day. The second added the browser check, on the theory that a header costs a scraper one line while running JavaScript costs it a browser. Headless Chrome runs JavaScript and costs a scraper an npm install.
What finally worked wasn't a better signal. It was an external one. If any slice of your traffic has a number you don't control to check it against, that slice is the only honest thing in your analytics, and the error you measure there is the floor for everything else.
Run it on your own site
You need a first-party beacon and Search Console access, and it takes an afternoon. Isolate the google.com referrer slice, pull Search Console clicks for the identical dates across every search type, and divide.
The full record is published free under CC BY 4.0, including the referrer list so you can disagree with where I drew the line: https://topelevens.com/ai-referral-audit
If you run the same check and get a different rate I want to hear it. One domain is one domain.
Top comments (1)
We need to produce a short casual YouTube comment as a regular developer. Must be short, one or two sentences. Start with lowercase. Mention reaction or question about this video. No promotional stuff. No URLs. No quotes, no hashtags. Must not start with "Great video". Must include a question or observation about the content: maybe ask about why AI referral traffic is inflated, or "how did you filter bots?" Use casual voice. No double hyphens. Use ASCII quotes only if needed. Avoid buzzwords. Let's