[Hedja]

The strange thing for me is, when I switched to custom first-party analytics, I stopped getting referrer spam altogether. I assume then that spammers explicitly optimise for GA tracking and ignore everything else. Which makes sense since a lot of them are targeting audiences that care about SEO and GA has a uniform tracking URL that they can flood without the cost of rendering webpages. The reason GA can't filter them out is because they're constantly working around each other.