How do I exclude fake direct load traffic from networks in Google Analytics?

[ServiceMichael]

Starting on Friday 1/20, we noticed a huge, unnatural spike in Direct Load traffic. While researching where it was coming from, the big flags were huge spikes in countries that normally only have <5 sessions a month like Russia, Singapore, Brazil, etc., each sending 1400 a week, with >99% bounce rate and <0:00:05 average session duration.

While looking into networks, we saw an influx in Networks that had never sent traffic before, each with >1300 sessions a week, 100% bounce rate, and 0:00:00 session duration. The list of these Networks are:

astute hosting usa incorporated
nephoscale inc.
network transit holdings llc
serverbeach
coreix ltd
2ezhost llp
nforce entertainment b.v.
mir telematiki ltd
servers australia pty ltd wholesale services provider for abuse
reliablehosting
dimenoc servicos de informatica ltda
c0715718213

I have seen a lot of guides of filtering out Referral traffic, but these are all coming in as Direct Load and are skewing our Direct Load results. Any idea how to filter or remove this traffic from Google Analytics?

[DmitriiK]

Then you need to look into ghost traffic. That article has the link at the bottom, and couple last sections are about it

[ServiceMichael]

Hmm, unfortunately these are resolving to our hostname

[DmitriiK]

Howdy.

What you need to do is create a filtered view or segment, where you would include only traffic from hostname, which matches your website. Here is an awesome guide: https://moz.com/blog/stop-ghost-spam-in-google-analytics-with-one-filter