Thank you, Lindy, for checking the raw connection logs. This is very helpful.

I have now performed the hostname check you suggested in GA4.

The result is interesting: the traffic GA4 attributes to the United States, Brazil and Colombia is reported with the legitimate hostname www.planete-citroen.com.

At the time of this screenshot, GA4 reports:

France: 4,467 views

United States: 3,529 views

Brazil: 1,190 views

Colombia: 992 views

All of these views are associated with www.planete-citroen.com. There are no blank, (not set), or unrelated hostnames shown.

The GA4 interface is in French: “Nom d'hôte” means “Hostname” and “Vues” means “Views”.

Therefore, it appears that a valid-hostname filter would not remove this abnormal traffic in my case.

I understand that this does not necessarily mean these requests actually reached the Invision infrastructure, since spoofed GA4 events could presumably also include the legitimate hostname.

Does this result still look consistent with GA4 measurement/phantom traffic from your perspective? If so, is there another GA4 dimension or parameter you would recommend checking to confirm it?

Thank you again for investigating this.

Hi Lindy,

Just a quick update, as there has been a significant change since my message yesterday which may be useful for your investigation.

I have not made any changes on my side to the site or to the GA4 configuration.

Since approximately yesterday afternoon, the abnormal international traffic reported by GA4 has dropped very significantly. More importantly, this change has continued overnight and throughout today.

At around 13:20 today, GA4 reports:

France: 5,144 views (68.84%)

United States: 536 views (7.17%)

Brazil: 257 views (3.44%)

Colombia: 236 views (3.16%)

Ecuador: 130 views (1.74%)

By comparison, at the time of my previous message yesterday, GA4 was reporting:

France: 4,467 views

United States: 3,529 views

Brazil: 1,190 views

Colombia: 992 views

The GA4 real-time map is also now overwhelmingly concentrated on France and nearby European countries, whereas previously there was substantial activity from the United States and South America.

The abnormal international traffic has dropped dramatically, while normal French traffic has continued to increase.

Interestingly, during the same period, I have also seen a significant improvement in Google AdSense performance.

At approximately the same time yesterday, the AdSense page RPM was around €1.09. Today, at around 13:20, it is €3.66, despite having fewer page views. Ad impressions have also increased significantly: approximately 10,900 today compared with 6,530 at a similar time yesterday.

I understand that this does not establish a causal relationship between the GA4 traffic and AdSense performance, but the timing of these two changes seems noteworthy.

As I have not changed anything on my side, I thought this sudden and sustained change might be useful information for your investigation.

Do you know whether any change or mitigation was applied on the Invision/Cloudflare side during this period.

If you or the Invision team did make any changes or apply any mitigation measures, I would of course like to sincerely thank you and the team. The improvement we have been seeing since yesterday afternoon is very significant and greatly appreciated.

I have attached screenshots of the current GA4 and AdSense reports for reference.

Thank you again for taking the time to investigate this issue and for your help.

Best regards,

Nicolas

Hi Lindy,

Yesterday was a good day again, with a very large majority of French traffic, and at the same time Google AdSense revenue went back up. This seems to confirm that the two issues were linked.

Today it still looks normal, so if it stays like this, the problem seems to be resolved on my side.

Could you just let me know if your team changed anything? I would like to understand what solved the problem.

Thanks again for your help.

Nicolas