Open data

Our AI referral traffic was 59x overstated

2026-08-31 to 2026-09-14 · 691 beacon fires in window · 237 referrer hosts · rebuilt 16 September 2026 · free to cite

I run a referral beacon on this site. It fires after the browser has parsed the page and run an effect, so it should only count people. Over 2026-08-31 to 2026-09-14 it recorded 59 visits referred by google.com. Google Search Console, which is Google's own log of the clicks Google sent, recorded 1 for the same dates. One of those two numbers is wrong, and it isn't Google's.

Search Console queried per type: web 1, discover 0, googleNews 0, news 0, image 0, video 0. Discover and News are separate reports, so leaving them out would have understated the true number and flattered ours.

Why this matters if you report AI referral traffic

The same beacon says 111 of the 691 visits in that window came from AI engines, led by chatgpt.com (48), bing.com (35), cn.bing.com (9). That number is produced by the same code, on the same visitors, in the same weeks as the google.com number that turned out to be 98.3% wrong. I have no way to check it, because there is no Search Console for ChatGPT. So I'm not going to publish it as traffic, and if your analytics shows you a rising AI referral line, you probably can't check yours either.

DataDome's Galileo threat research team described the mechanism on 5 February 2026. Scrapers set 'Referer': 'https://chatgpt.com/' because analytics tools accept the header without checking it, and security tools go easy on traffic that claims to come from a reputable domain. They measured it from inside a bot defence network on large sites. This is the same effect measured from the other end, on a site small enough that the true number is knowable.

A quarter of our visits came from places a software buyer has never been

The google.com comparison is the proof. The referrer list is the smell that sent me looking. This site ranks business software. 45 beacon fires, 6.5% of the total, carry a referrer no public browser can produce at all: loopback, private LAN addresses and bare machine names. Another 132, 19.1%, came from streaming, gaming, adult and consumer retail sites.

Method

A first-party beacon on topelevens.com records one fact per visit: the referrer host and the path, after the browser has parsed the document and run an effect. No IP, no cookie, no user agent, no query string. The google.com slice of that record is then compared against Google Search Console for the identical window, summed across every search type.

The beacon stores one row per visit: the referrer host and the path. No IP, no cookie, no user agent, no query string, no identifier of any kind. That's a privacy choice made before any of this, and it's also why this page can tell you how big the error is and not who caused it.

Two earlier versions of this instrument were thrown out for claiming more than they could prove, on 31 August and 2 September. The second added the browser check on the theory that a referrer costs a scraper one line while running JavaScript costs it a browser. Headless Chrome runs JavaScript and costs a scraper an npm install. I stopped trying to build a signal a bot can't fake, and started checking the signal I have against a number I don't control.

What this cannot tell you

• How many of the AI referral counts are real. There is no Search Console for ChatGPT, so the 98.3% measured on google.com is an observation about one referrer, not a rate proven to apply to the others.
• Whether the same rate holds on a large site. This is one domain with 656 Search Console impressions in the window, which is why the true number is small enough to check at all.
• Who is sending the traffic. The beacon stores no IP and no user agent by design, so this measures the size of the error and not its author.